Direct answer

Closed source can be a trade secret; published or uncontrolled code usually cannot.

Source, build scripts, proprietary algorithms and non-public APIs often satisfy the value and secrecy limbs if they are not shipped in readable form and are not on a public repo. Corresponding measures mean repository permissions, no personal clones, NDAs, and exit removal of laptops. You may also hold software copyright in the same code — that is a parallel right with different proof. Open-source components inside the stack are not your secret. Criminal thresholds for ‘especially serious’ trade-secret theft can be relevant for large code dumps.

The classification screen

4 questions before you choose the route.

This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.

01

Is the code actually closed?

Public repos, leaked packages and client-side JS are not secrets.

Secrecy
02

Who had clone rights?

Contractors, vendors and former staff with still-active tokens.

Access
03

Copyright, patent, or secret — or all three?

Do not pick one theory if the facts support a stack.

Rights
04

What was taken — a dump or a reimplementation?

Literal copy vs clean-room rewrite changes the case.

Copying

Working rule: Map the regulated role before marketing or launch in China.

What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal
Ask the operating question
Why it changes the route
Public GitHub
Was the repo public or copied to a personal account?
Secrecy and measures both take a hit.
Vendor escrow
Did a supplier receive full source without an NNN?
The leak path is contractual as well as AUCL.
Only object code shipped
Did the defendant reverse-engineer a distributed binary?
Reverse engineering of a lawfully obtained product is a different, harder AUCL fight.
Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01Repo and access logWho cloned, when, and whether it was public.
02MeasuresSSO, DLP, NDAs and device policy.
03ComparisonDiffs, unique comments, bugs and watermark strings.
04Copyright registrationIf you registered software copyright, the certificate and deposit.
Common confusions

Questions people ask before they build.

Short answers for orientation. The right result can change with the service model and current rules.

Does software copyright registration make it a trade secret?

No. Registration is copyright evidence and may even disclose deposit material. Trade-secret status still needs secrecy and measures.

Can we still sue if we used a lot of open source?

Yes as to the proprietary layer. Identify what is yours; do not claim Linux as your secret.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

National laws database (NPC)
Anti-Unfair Competition Law (gov.cn)
CNIPA
Supreme People’s Court