They have some automated review mechanisms to try and stop you from downloading and running arbitrary code, but it's definitely possible to do it. In my case I

They have some automated review mechanisms to try and stop you from downloading and running arbitrary code, but it's definitely possible to do it. In my case I settled for having a remote configuration file that I could use to disable features in an emergency (and had to use it a couple times), as a compromise since I didn't want to pull down arbitrary code but was tired of getting burned by it taking a week to push a bug fix.