⚠ Git's Open by DesignLow threat

GitHub's grip carries an unusual vulnerability written into its very foundation: Git, the version-control system beneath it, is open, decentralized¹, and designed from the start to make code portable. Every developer already holds a complete copy of a repository's history on their own machine, and moving a project to a rival host — GitLab, a self-hosted server, or a competitor — is technically trivial. Unlike an enterprise stack woven into a thousand workflows, GitHub's lock-in is thin at the technical level.

This matters because GitHub's stickiness is social rather than structural, and social loyalty is more fickle than structural dependence. The community stays because the network — the collaborators, the reputations, the discovery — is there, but a network held by goodwill can move if the goodwill sours. A serious misstep by Microsoft, or a compelling rival the community decides to rally to, could trigger exactly the kind of collective move that Git's portability makes technically easy.

What keeps this latent is that network effects are genuinely powerful, and the whole world's developers do not coordinate a move easily; GitHub's dominance of open-source mindshare is enormous and self-reinforcing, and Microsoft has so far run GitHub with a light touch that has kept the community largely onside. The social graph, once built, is real inertia even when the code is portable.

Keep it at low-to-moderate. The technical portability is a permanent latent vulnerability that distinguishes GitHub from Microsoft's stickier enterprise moats — the lock-in depends on continued goodwill rather than structural entanglement — but the network effect is strong and Microsoft has been careful to preserve it. The danger bites only if Microsoft squanders the trust, which is within its own power to avoid.