They don't want to release it... I complained about that several times, nobody really cared. They said they would most likely release the source code shortly after the genesis bloc, but yeah as expected the don't. I only ran this shit inside a whonix vm as I also expect the code to be completely insecure. You can disassemble the java code and get pretty good results. It is complete garbage, also he said that they have the power to delete markets, so far I have not seen that piece of code, but I only had a short look at it.
And oh yeah they have about 600k$ laying around and they don't invest in a penetration test of some sort by externals. Every legit project does that, heat does not. But yeah they released this completely broken piece of shit in which nothing works. Not sure how a legit test should work as the known bugs are probably too many to count.