Regarding the code, I don't believe it is a concern for most of the people, because they use 3rd party git repo anyway, which has exactly the same level of risk