I think that largely depends on who's maintaining the official repo. See what happened when oh-my-zsh got careless in testing pull requests: https://github.com

I think that largely depends on who's maintaining the official repo. See what happened when oh-my-zsh got careless in testing pull requests: https://github.com/robbyrussell/oh-my-zsh/pull/1395/files#L1R7 https://github.com/robbyrussell/oh-my-zsh/pull/1395/files#L1... everyone who got the update (tons of people, as it's self-updating) had their $HOME screwed up, basically breaking the entire shell. Point being that trust only goes so far here: proper code reviews are what stop these problems.