"Once i've got the base of the system solid and working I will then implement proper security measures on-top of that." I understand your sentiment, but it's w

"Once i've got the base of the system solid and working I will then implement proper security measures on-top of that." I understand your sentiment, but it's wrong. You need to take into account your userbase, potential or otherwise. There are those which will be overzealous and not concerned about security and will use your stuff anyways, then there are those people who find themselves compelled (against their will) to use it, secure or otherwise. Because this software strongly facilitates the later group, releasing it in this fashion represents a security risk and is unethical, wrong, even. Just because you can manufacture a bomb does not mean you should, not should you be distributing bomb making kits. Also, perhaps your time would be better spent building this functionality into existing package managers, rather than this one? There are certainly enough package managers out there, I'm not convinced this is even a good idea.