[aianus]

> backup files which could leak source code

Would an open source app not be PCI compliant?

[thmorton]

Nah, that would be fine. It's not a problem with the source being available, more the fact that the file could contain sensitive information like passwords (like say in a config.php file).