Just remember that brew still must never be installed on a machine you need to be able to trust.

The supply chain security policy of brew is basically non existent and optimized for low-friction contributions. Think wikipedia. No enforced commit signing, review signing, or multi-party release signing, and thus everything is honor system.

Do not put brew anywhere near systems that access production or even on systems used to review production-bound code.

https://docs.brew.sh/Homebrew-Security-and-Supply-Chain

We take supply chain security very seriously, moreso than many package managers.

How is that any different from PyPI, npm, cargo, etc?