3 ms·

So they are also able to push directly to master, push bad changes, backdoor/add malware to your projects and make a release. I would be careful with this.

• diggan 10y ago
  I'm one of the people who do this, if anyone is doing more significant change than just updating the readme/fixing a typo, give them collaborator status after checking out their profile. I think the benefit of people feeling proud of being a collaborator and trust from me, is bigger than the risk of someone ruining their own reputation by adding a backdoor. But, most of my projects are tiny-ish and not even close to big, so I guess I have a bit more flexibility in this. EDIT: Just remembered that you can activate "Protected Branches" on Github (and I'm sure something similar exists for Bitbucket and Gitlab as well) that disables pushes straight to master.
• lmm 10y ago
  They can't make a release without the signing keys. (Well, they can, but everyone will know it wasn't one of mine)
• sotojuan 10y ago
  It's all about trust. So far no one I know has been burned.
• mrob 10y ago
  You're not just trusting them to have good intentions, you're also trusting them to keep their system secure. If you have commit access to a popular project then your commit credentials are a high value target. What do you know about their security practices?