It work like this according to this old image https://pbs.twimg.com/media/Cylz-a0WQAAzJ6i.jpg So Jolla will oversee any code going back in to SailfishOS to maintain independent offering. Leaking code is probably prohibited by commercial contracts.