CVS is the authoritative repository of code, and they recommend to users to use that or reposync (built atop of CVS) to keep their system updated.
There is also a GitHub mirror , and got is an OpenBSD project, and I suspect a number of devs use one of those for local work until it’s time to push the changes to the authoritative tree.
There’s been a few of those in the UK; this article quotes
"><SCRIPT SRC=HTTPS://MJT.XSS.HT> LTD
and; DROP TABLE “COMPANIES”;-- LTD
.