Leaking the sources is a very bad idea in my opinion.

So you read them, then what? Every bit of code you write after that could be tainted from what you've read. You risk being sued if someone finds any similarities between your code and the stolen code. None of the leaked sources could be included in CSSU without jeopardising the whole project. It may even put an end to any future reverse engineering efforts as there are bound to be similarities in the resultant code. It would be very difficult to prove that it didn't come from stolen code.