shouldiuse.io

Categories

VERDICT

Should I use Square Open Source?

Square/Block's open-source portal — free developer libraries, not a commercial product - square.github.io

Worth it. If you write Android, Java, or Kotlin software, use these free libraries — OkHttp and Retrofit are industry standards. If you're a business buyer looking for Square's POS or payments product, this page is not that; it's just code.

Confidence

Medium. Based on 30+ public sources; mostly developer-community threads and security listings. No product reviews exist since this is free code, not a commercial product.

Ratings

  • Value for money
  • Ease of useNo evidence either way; developer integration required.
  • Feature depth
  • Support quality
  • Security posture

Pricing

$0

Everything

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • Android and Java developers
  • Kotlin-first teams
  • Security-conscious engineering orgs (Keywhiz)
  • AI tooling teams (Goose)

Not for

  • Non-technical buyers wanting a finished app
  • Anyone shopping for Square POS or payments
  • Teams needing vendor SLAs or paid support
  • No-code or small-business buyers

Gotchas - check before you buy

high

Retrofit's JAXB converter had an XXE vulnerability in older versions; pin patched releases.

medium

Dependency links changed when repos moved to the cashapp org — update before upgrading.

medium

Bug bounty occasionally paused; don't assume year-round triage.

low

Unrelated to Square POS/payments — different product, different site entirely.

Pros and cons

Pros

  • Free — every project is open source, no licensing fees.
  • OkHttp and Retrofit became Android's default networking stack.
  • Heavy Kotlin investment improves developer experience.
  • Public bug bounty program invites outside security testing.
  • Massive community adoption means abundant docs and answers.

Cons

  • Not a product: no support desk, no SLA, just code.
  • You own patching — Retrofit shipped a past XXE CVE.
  • Some repos moved to the Cash App GitHub org, breaking references.
  • Bug bounty program has been temporarily paused before.

Sources & method

Analyzed 10/02/2026 - 14 sources - Transparent posture: published advisories, CVE disclosures, and a bug bounty program that has been paused at times.

official x4review x4security x4news x2
  • CVE-2018-1000844: Retrofit JAXB XXE, Older Retrofit versions had an XML External Entity vulnerability in the JAXB converter, with SSRF/file-read risk; fixed in later releases.
  • OkHttp Certificate Pinner vulnerability (2016), Disclosed and patched by Square in 2016; an example of their public disclosure practice.

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 14

    Sources

  • Analyzed

  • Value for money: 5/5. Free and open source; nothing to pay.
  • Ease of use. No evidence either way; developer integration required.
  • Feature depth: 4/5. Huge catalog: networking, DI, secrets, AI agents.
  • Support quality: 2/5. Community-only support; no vendor SLA exists.
  • Security posture: 4/5. Bug bounty, public advisories, past CVEs patched.
  • $0 Starting price All projects free and open source
  • Yes Free tier No paid tier exists
  • OkHttp, Retrofit, Keywhiz Flagship projects Plus Block's Goose AI agent
  • Block, Inc. Maintained by Formerly Square; owns Cash App, Afterpay

Pricing

Everything

$0

  • All libraries open source
  • Community support via GitHub

Security

Transparent posture: published advisories, CVE disclosures, and a bug bounty program that has been paused at times.

  • CVE-2018-1000844: Retrofit JAXB XXEOlder Retrofit versions had an XML External Entity vulnerability in the JAXB converter, with SSRF/file-read risk; fixed in later releases.⁵
  • OkHttp Certificate Pinner vulnerability (2016)Disclosed and patched by Square in 2016; an example of their public disclosure practice.⁸

What users say

Android developers treat Square's libraries as near-indispensable infrastructure, though some confuse the portal with Square's payments business.

“How does Square make so many open source libraries?”
Reddit, r/androiddev
“Is square open source?”
Reddit, r/opensource
“Square has moved some of their repos on GitHub to a cashapp”
Reddit, r/androiddev

Alternatives

Compare Square Open Source with each alternative.

  • Square POS (the payments product)

    If you wanted the merchant payments product, go there.

  • Ktor Client

    Kotlin-native HTTP client if you want Kotlin-first design.

  • Google Jetpack libraries

    First-party Android libraries backed by Google.

  • Awesome Kotlin lists

    Community catalogs if you just want options.

Companies that use it

  • Block (Square)13
  • Speechify
  • AllSquare (app)
Full analysis

Based on 30+ public sources; mostly developer-community threads and security listings. No product reviews exist since this is free code, not a commercial product.

Free open-source dev libraries (OkHttp, Retrofit) — a no-brainer for Android teams; useless if you wanted Square's payments product.

Methodology

Based on 30+ public sources; mostly developer-community threads and security listings. No product reviews exist since this is free code, not a commercial product.

Sources

  1. Square Open Source portalsquare.github.io
    official
  2. Square Open Source Portal (GitHub repo)github.com
    official
  3. Square Open Source ♥s Kotlindeveloper.squareup.com
    official
  4. Square's Open Approach to Codesquareup.com
    official
  5. CVE-2018-1000844 — Retrofit XXEnvd.nist.gov
    security
  6. Square Open Source Bug Bounty (HackerOne)hackerone.com
    security
  7. Bug Bounty: Block Open Source (Bugcrowd)bugcrowd.com
    security
  8. Vulnerability in OkHttp's Certificate Pinnerdeveloper.squareup.com
    security
  9. OkHttp — Square's open source HTTP client (Reddit)reddit.com
    review
  10. How does Square make so many open source libraries? (Reddit)reddit.com
    review
  11. PSA: repos moved to cashapp org (Reddit)reddit.com
    review
  12. Best POS for a small business? (Reddit)reddit.com
    review
  13. Block engineer on open-source AI agent (Business Insider)businessinsider.com
    news
  14. Square Keywhiz Alternatives & Competitorsfaun.dev
    news

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.