[kobzol]

I don't really see an attack surface for a dev dependency.

[conradludgate]

Your development machine, potentially with API keys and access tokens in `$HOME`, is the attack surface