[skrtskrt]

> then it becomes a real pain to track all the places where an end user could indirectly come in contact with service B

Easy solution: then you just publish your patches for anyone to get. Or just anyone with a login to your SaaS. If you haven't changed anything then they can just get the original source themselves.