Posted in
Fediverse
Good question, however the security model doesn't depend on the code being secret, and it shouldn't. The auth, signatures, permissions and input handling are standard and went through an OWASP review before launch.
What's closed is the anti-abuse layer, spam, rate-limit tuning, the signals for detecting ban evasion and coordinated accounts. Those work partly because spammers don't know the exact numbers. Lemmy's and Mastodon's are public and they get played for exactly that reason. Hope it helps :)