One thing stopping us adopting unlocked packages is the poor security around the hosting of the package version.
Performing a package create and version on the cli publishes the unlocked package to Salesforce servers with the installation protected only by a password.
In organisations with reasonable security controls around code leakage this seems unacceptable.
Anyone with a url and password can get the package code.
Has anyone seen an alternative or roadmap item that fixes this?
There are future plans to enhance security.
In future (safe harbor), we have plans to provide additional security mechanisms to enable enhanced security for your packages.
What form this will take, or when it will be available, is not known at this time.
To be fair, needing to have the package ID and password is already a pretty high bar to entry. Unless your employees are leaking/stealing passwords, this system is actually reasonably secure. And if they are, you should be terminating employments and taking them to court for breach of contract.
A multitude of companies and ISVs all across the globe are actively using this feature. I haven't heard of any security breaches because someone got someone else's unlocked package metadata. As long as you take reasonable precautions to prevent this sort of leakage to begin with, there shouldn't be too much harm that can be done.
