> there is little risk in assuming good faith until demonstrated otherwise. The risk is that a malicious user fakes good commits, earns commit rights, and then

> there is little risk in assuming good faith until demonstrated otherwise. The risk is that a malicious user fakes good commits, earns commit rights, and then pushes malware that is then installed by unsuspecting downstream users before the code is found and reverted. This can be partially mitigated by making sure they don’t have permission to create a release, but it would still be possible to compromise developers working off the main branch.