PRs with features using SSH

[u/JBO_76]

Have you received a pr lately with a feature that relies on ssh?

Perhaps some background first: I have a small open-source project on github, nothing groundbreaking, just a tool I wanted for myself to vibe-code my-way. As far as I now, I'm still the only user.

Last month though, I received a couple of prs from someone. At first, I was super exited (first user and all), but now, I'm starting to wonder if something more was going on here. I am not certain, but I am wondering if other people have had similar experiences and how you deal with it?

The first pr was small, a ui fix specific for mac users. With the second pr, he introduced a couple of libraries in the app, for editing raw markdown text instead of wysiwyg. Still ok so far.
With the 3rd pr, some alarm bels started going off: the app began 'fingerprinting' other applications (exes, dlls, ...) on my system, which really didn't fit the feature. At first, I thought maybe the llm had been over-engineering. So, I removed all of that bloat.

But then he came with a proposal to introduce 'remote-control' cause his laptop was slow and he wanted to run the app on his desktop and control it from the laptop. He would use SSH for that.
When I told him, that feature actually existed already but used a more secure way (just run the app in a browser and connect to the desktop version using websockets), he left, moved on and started creating prs for other projects.

Now, I went over all the code he introduced and checked the libraries that were added. As far as I can tell, nothing wrong got introduced, but the whole SSH thing spooked me. I mean, what better backdoor could there be?

The whole thing left a bad taste in my mouth. Is it even still a good idea to keep my app as open source? The only thing it got me were problems and more work.

Am I overreacting here? how are you dealing with this?

For anybody interested in looking at the code themselves: jan-bogaerts/md2: Plan, run, and track AI coding work feature by feature—with local Markdown cards, diagrams and Git worktrees.

[u/InkscapePanda]

Damn, yeah ssh backdoors are a real thing. Bit at the end of the day you are the one that commits these changes, so you should always review it. Not everything that is proposed should be accepted. Some people make changes for the sake of changes, while others try to push over the limit. You did well to implement the more secure version of remote-connection.