Open source is only as useful as your ability to watch the work happen. NordVPN just changed how much of that you get to see on its Linux client.
The company announced that day-to-day development of the app is moving to a self-hosted GitLab instance. The license stays the same, the source remains public, and you can still read it, build it, and send patches. What changes is cadence. Instead of a stream of commits on GitHub, the public repository will get a full source snapshot with each release, roughly once a month.
NordVPN gives two reasons. First, security. Under the old setup, a commit describing a vulnerability fix could sit in public for days before the patched build reached everyone. That’s a real problem, and anyone who has watched attackers diff open commits knows it. Second, operations. The pipeline ran across GitHub and NordVPN’s own infrastructure, so a GitHub outage could block releases, and keeping both in sync was overhead the company says users never benefited from.
Both arguments are plausible. Publishing a fix before users can install it is a known weakness of open development, and many projects solve it with embargoed patches or private security branches. NordVPN chose a broader answer: hide the history until release day.
And that has a cost. Continuous commits let outside researchers see what changed, when, and why. Snapshots compress a month of work into one drop, which makes review harder. Spotting a questionable change in a single large diff is much tougher than in small commits with messages attached. For a VPN client that runs with elevated privileges on your machine, that matters.
There’s context here too. VPN providers have spent years trying to earn trust through audits, open clients, and no-logs claims, because users can’t verify much else. Open source clients are one of the few things you can actually check. Reproducible builds and signed releases would let you confirm that the binary you install matches the published code. The announcement says nothing about that, and it should.
Some things do remain intact. Issues and pull requests stay on GitHub, and merged contributions ship in the next release with credit to the contributor. That keeps the community door open, though the company controls the pace behind it.
So is this a reasonable security tradeoff or a quiet retreat from transparency? Probably a bit of both. The vulnerability-window concern is legitimate. But a monthly code dump means less public scrutiny between releases, and users are asked to take the internal process on trust. If NordVPN wants to keep the credibility of an open client, it should publish security advisories alongside each snapshot and make builds verifiable. Until then, Linux users should watch the first few snapshots closely.