> The Pull Request Hack probably isn't suitable if you're running big projects. And it is almost certainly a stupid idea if you write code which is actively use

> The Pull Request Hack probably isn't suitable if you're running big projects. And it is almost certainly a stupid idea if you write code which is actively used by multiple downstream projects. And if your stuff has even the slightest chance of compromising security then you're better off sticking to trusted members. Just about any code project in any real programming language targeting any not super locked-down platform has a chance of compromising security, so that’s not a great criterion. The project given as an example (collection of super small SVG icons) is an outlier, and even there it’s possible to smuggle a short embedded script into a <1KB SVG, e.g. you can read/manipulate DOM (if the <svg> is directly in DOM as opposed to in a separate document) and use fetch() without problem in an embedded script tag. I’ve assigned strangers as maintainers on moderately popular projects (>1k GitHub stars) and the results have been satisfactory so far. Of course there’s a possibility that one day I’ll end up on HN front page having to explain why my project is shipping malware, but that chance seems really slim.