I'm participating in the Ubuntu App Showdown and my submission is going to make use of third-party web services that use OAuth to release their protected data to clients. Given that the rules state that the app must be open source, I was wondering if an exemption could be made for a single file containing the OAuth secrets, so that they are not being freely distributed.
The risk with a distributed OAuth secret is that they are bound to specific apps so the service can tell which app is requesting what data from which user. If these secrets get into the open, it will allow parties with malicious intent to imitate a request coming from a legitimate app, causing that app to be blamed for any wrong-doing committed using the compromised credentials.
I'd be willing to provide the credentials file to the judges in private if they so desire.
Given the general requirement for submissions to the software centre to be open source, perhaps such an exemption could be made in the submission policy as well.