General · EdgepediaSeptember 17, 20269 min read

Source code

Source code is the set of statements and instructions written by a human being in a programming language, such as C, Java, or Python, that a person familiar with the language can read and that a computer executes either directly via an interpreter or after conversion into object code by an assembler or compiler.¹^•²⁰ It is the form in which software is authored, reviewed, measured, licensed, and legally protected, and it is distinct from the machine-readable object code into which it is typically translated.¹

Key fact	Detail
Definition	Statements and instructions written by a human in a programming language, comprehensible to a person familiar with that language, which may be executed by a computer either after conversion to object code or by an interpreter¹^•²⁰
Object code	The program's representation in machine language, typically binary, octal, or hexadecimal, comprehensible to a computer but not intended to be read by human beings¹
Legal status	Source and object code are treated as two representations of the same copyrighted work; trade secret law is the most widely used protection mechanism¹^•²
Copyright scope	Protection covers the copyrightable expression in the program, not ideas, program logic, algorithms, systems, methods, concepts, or layouts³
Most studied metrics	The Chidamber and Kemerer metrics, lines of code, and cyclomatic complexity dominate research on source code measurement⁴
Supply chain scale	Public registries including PyPI, Maven Central, crates.io, RubyGems, npm, and NuGet serve trillions of downloads each year, growing 30% to 50% per year⁵
Historical releases	Landmark code, including the 1969-1972 APL\360 XM6 system (37,567 lines) and Microsoft's 86-DOS 1.00 listings, has been made publicly available for study⁶^•⁷

Source code and object code

A program's source code is written to be read and modified by people. Object code, by contrast, is the representation of the same program in machine language, usually binary, octal, or hexadecimal coding, and is not intended to be read by human beings.¹ The conversion process involves an assembler or compiler, although an interpreter may execute source code without first producing object code.¹^•²⁰

The two forms are not independent works. The U.S. Copyright Office views source code and object code as two representations of the same work and, as a general rule, will not issue separate registrations for the two versions of the same program.¹ Implementation choices vary by language: APL\360, for example, was implemented as an interpreter rather than a compiler that generated machine code, storing programs in an internal form called a codestring that corresponded directly to what the user had typed.⁶

Legal protection

Trade secrets and copyright. Trade secret law is the legal mechanism most widely used to protect source code. Copyright also protects the expression of a programmer's ideas in code, and truly innovative software can be patented, but these alternatives leave gaps: copyright protects the specific way a piece of code is written, not the more general idea of how the software functions, and patent protection is limited in time and often unavailable for parts of a software system. These limitations have meant that software producers rely mostly on trade secret protection.² Article 39 of the WTO Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) offers protection for trade secrets.²

Under United States law, copyright protection extends to all the copyrightable expression embodied in a computer program, which the Copyright Act defines as a set of statements or instructions to be used directly or indirectly in a computer to bring about a certain result. Protection is not available for ideas, program logic, algorithms, systems, methods, concepts, or layouts.³

Registration practice. Registering a program with the U.S. Copyright Office normally involves depositing source code, and the rules accommodate confidentiality. If the code contains trade secret material, the depositor may block out those portions, provided the blocked portions represent less than fifty percent of the deposit and the remaining portions contain an appreciable amount of copyrightable expression; the Office strictly applies these redaction standards and will refuse a nonconforming deposit.⁸ For derivative programs, the deposit is typically the first and last twenty-five pages of source code, or fifty pages containing the new material.⁸

Disclosure in commerce. Source code has become an explicit subject of international trade policy. Recent bilateral trade agreements include provisions that place limitations on the power of public authorities to mandate access to source code, going further than Article 39 of TRIPS, while generally preserving exceptions that allow a regulatory body or judicial authority to require source code or an algorithm expressed in it for a specific investigation, inspection, or judicial proceeding, subject to safeguards against unauthorized disclosure.² Access to source code can also serve procurement due diligence, letting a purchasing body assess regulatory compliance and lawfulness at a detailed level.²

Open source and the supply chain

Free and open source software licenses allow software to be freely used, modified, and shared; anyone can use it, commercially or non-commercially, subject to compliance with the license conditions. Copyleft licenses such as the GNU General Public License and the Mozilla Public License Version 2 add the obligation that distribution of the software in source code form, including modifications, must remain under the same license terms.⁹

The scale of source code distribution has grown into what its observers describe as critical infrastructure. Public package registries, which distribute source-linked packages for ecosystems such as Python, Java, Rust, Ruby, JavaScript, and .NET, now serve trillions of downloads each year, with download volumes growing by between 30% and 50% per year; the OpenSSF Governing Board has called for more enterprise support, saying the current funding model is no longer sustainable.⁵ Sonatype's 2026 State of the Software Supply Chain Report describes open source as the substrate of software delivery, pulled continuously by automated pipelines, and reports that attackers increasingly treat open source as a delivery channel rather than an afterthought, with malware campaigns optimized for developer workflows and targeting credentials, CI secrets, and build environments.¹⁰ Developers themselves have become high-value targets because they hold cloud credentials, SSH keys, npm publish tokens, and direct access to source code.¹¹

Maintenance activity correlates with security posture in measurable ways. Aggregate supply chain research reports that repositories with no release in two years average 2.6 out of 10 on the OpenSSF Scorecard, against 4.5 for active repositories.¹² In Europe, regulatory initiatives including NIS2, DORA, and the Cyber Resilience Act have been framed as converging on a single problem: securing the software supply chains underpinning the economy.¹³

Measuring source code quality

Source code metrics are extracted from the code itself, and their values support conclusions about the quality attributes they measure; they are considered essential components of the software measurement process.⁴ A systematic mapping study of the field found that the Chidamber and Kemerer (CK) metrics, along with lines of code and cyclomatic complexity, are the most studied, that fault prediction and complexity are recurrent topics of interest, and that Java benchmark systems are the most commonly measured systems in research.⁴

Quality is treated as a construct with multiple dimensions. One analysis frames software code quality as having three dimensions, maintainability, reliability, and functionality, and divides metrics into monotonic ones that consistently influence quality and non-monotonic ones that lack a consistent relationship; using 36,460 high-quality open-source repositories with metrics from SonarQube and CK, the authors proposed a distribution-based method for scoring both kinds.¹⁴ Static analysis tools are widely used in practice: SonarQube, which classifies issues as code smells, bugs, and vulnerabilities affecting maintainability, reliability, and security, is described as the most widely used such tool in both academia and industry, and a longitudinal study of 57 open-source Python projects, each with at least six releases, used it to track how issues are composed, distributed, and evolve over time.¹⁵ Metrics are also used predictively, for example in estimating bug severity from source code metrics and static analysis findings,¹⁶ though research on source code metrics as features for defect prediction models reports contrasting results about their applicability.¹⁷

Historical source code as a record

Because source code records how a system actually worked, preserved code has become an object of historical study. The Computer History Museum's Historical Source Code series has released, with permission, landmark code including MacPaint and QuickDraw, Adobe Photoshop, Apple II DOS, early MS-DOS, Microsoft Word for Windows 1.1a, early CP/M, and the Xerox Alto.⁶ Its APL release covers the 1969-1972 XM6 version of APL\360, written entirely in 360 assembly language: a text file of 37,567 lines in 90 files, licensed for non-commercial use, which implemented a complete timesharing operating system together with the language and served as many as 50 simultaneous users.⁶

Microsoft has similarly opened chapters of its own history. In 2025 it published Tim Paterson's listings for the 86-DOS 1.00 kernel, PC-DOS 1.00 pre-release kernels and utilities, and the Microsoft BASIC-86 Compiler runtime library on GitHub; Microsoft had purchased 86-DOS from Seattle Computer Products and Paterson for a figure in the region of $75,000.⁷ It has also released the assembly source for its 6502 BASIC interpreter, code written by co-founder Bill Gates.¹⁸ Programming-language history is likewise traced through code and its documentation: C came into being in 1969-1973 in parallel with early Unix development, its most creative period occurring in 1972, and the first widely available description of the language appeared as The C Programming Language in 1978.¹⁹

References

Topic: Encyclopedia › Technology and the built world › Computing and digital systems › Software and programming › Programming languages › Programming language concepts

Initially written Sep 17, 2026 · Reviewed: Sep 30, 2026; Oct 15, 2026 · Edited: Sep 30, 2026; Oct 15, 2026 · Last review: Oct 15, 2026

Notice something wrong?