Source is available to the public under their own custom licence, but you cannot use it commercially. Server side is closed. So you just know there is no malware inside and you can propose a bugfix, that’s not enough to be open source, yet they misleading call it that.