Right, still a security risk, but at least if I come back to a project after a year or two I can know that even if some malicious group took over a project, the

Right, still a security risk, but at least if I come back to a project after a year or two I can know that even if some malicious group took over a project, they at least didn't backport a crypto-miner or worse into my script.