Wasn't it CC itself the one that leaked, well, itself? It's completely vibe-coded, which I assume means it does its own build step too, which means it leaked itself.
The only breach of best-practice I see here is using an LLM for coding.
And frankly at that point Claude Code as software doesn't matter anymore. It is about their models, they could throw it away, rewrite from scratch, etc, it wouldn't be a big deal.
Claude Code as a harness was never likely going to be for 10 years, because there would be so many of these harnesses, all different, the direction may change, etc.
As I understand someone internally quickly vibecoded for themselves only as a productivity tool, and then they realized internally how productive it can be, they decided to release it and people found it so productive they got hugely popular now thanks to that while otherwise would have been eaten out by OpenAI.
Also if requirements for this had to came from product it would have never even happened in the first place. As it was engineer trying to optimize their own workflow.
The only reason they decided to hide source code is to delay competitors imo and it wasn't related to security or anything, but by now OpenCode etc are objectively better tools anyway.