Isn't getting it from GitHub the first time vulnerable to attack? Consider when you're scaling up or replacing a failed host.