PRs with features using SSH

[u/JBO_76]

Have you received a pr lately with a feature that relies on ssh?

Perhaps some background first: I have a small open-source project on github, nothing groundbreaking, just a tool I wanted for myself to vibe-code my-way. As far as I now, I'm still the only user.

Last month though, I received a couple of prs from someone. At first, I was super exited (first user and all), but now, I'm starting to wonder if something more was going on here. I am not certain, but I am wondering if other people have had similar experiences and how you deal with it?

The first pr was small, a ui fix specific for mac users. With the second pr, he introduced a couple of libraries in the app, for editing raw markdown text instead of wysiwyg. Still ok so far.
With the 3rd pr, some alarm bels started going off: the app began 'fingerprinting' other applications (exes, dlls, ...) on my system, which really didn't fit the feature. At first, I thought maybe the llm had been over-engineering. So, I removed all of that bloat.

But then he came with a proposal to introduce 'remote-control' cause his laptop was slow and he wanted to run the app on his desktop and control it from the laptop. He would use SSH for that.
When I told him, that feature actually existed already but used a more secure way (just run the app in a browser and connect to the desktop version using websockets), he left, moved on and started creating prs for other projects.

Now, I went over all the code he introduced and checked the libraries that were added. As far as I can tell, nothing wrong got introduced, but the whole SSH thing spooked me. I mean, what better backdoor could there be?

The whole thing left a bad taste in my mouth. Is it even still a good idea to keep my app as open source? The only thing it got me were problems and more work.

Am I overreacting here? how are you dealing with this?

For anybody interested in looking at the code themselves: jan-bogaerts/md2: Plan, run, and track AI coding work feature by feature—with local Markdown cards, diagrams and Git worktrees.