These products are distributed as open source and are not listed on the Salesforce AppExchange. That means they have not been through the Salesforce security review, and you should treat them the way you would treat any code you deploy into your own org.
What that means in practice:
- The full source is public. Read it, or have your security team read it, before you install anything.
- Install in a sandbox or Developer Edition org first, and test there before promoting to production.
- These tools read your org's metadata to do their work. They do not send your data anywhere outside your Salesforce org.
- Access is controlled by the permission sets included in each package. Assign them deliberately.
- The software is provided as is, without warranty. You are responsible for what you deploy into your production org.
If you would rather not install it yourself, we install, configure and support these tools as a paid service.