Your source is the asset
For a lot of organisations the codebase is the most valuable thing they own, and sending it to a shared service to be processed is not a risk decision anyone wants to sign. Whiteboxing removes the question rather than answering it.