Git trailers are just lines of text at the bottom of a commit that take note of some metadata. Common ones are Co-Authored-By, Reported-By, Reviewed-By or Signed-Off-By, all of them autodescriptive I think.

Magit has a way of adding trailers, just press C-c TAB or C-c C-i in commit view …

Emacs has no sandbox. Every package you install runs arbitrary Lisp with your full privileges: your files, your credentials, your network. This makes me really scared of installing new packages, or upgrading existing ones.

The packages most of us use are not vetted artifacts: MELPA builds from some repository (usually …