What about security issues in Fortran?

Speaking of GitHub, there is a neat trick in the way GitHub stores repositories, which you can exploit by git fetch and therefore now also by fpm.

Did you know that you can access any commit in a GitHub repository from any fork? If I would fork gtk-fortran and push a new commit (even on an orphaned branch), I could fetch from the URL of your main repository my completely unrelated commit again. I think they are even preserved indefinitely.

You won’t notice this if you clone the repository, because the objects you get by cloning only belong to the respective fork.