You're not just trusting them to have good intentions, you're also trusting them to keep their system secure. If you have commit access to a popular project the

You're not just trusting them to have good intentions, you're also trusting them to keep their system secure. If you have commit access to a popular project then your commit credentials are a high value target. What do you know about their security practices?