I'm wondering (from a security point of view) whether it is not best to add the repository as a submodule. That way you can stick to a specific commit. It provides you a way to preview the content of the submodule before updating it. Otherwise whatever is on the master branch of the repository you're including would become part of this build 🤔

Cherry pick a spesific commit version ?

would we be better off then forking that repo in the faf org that way is only updated by the faf org ?

I don't know, @Sheikah45 what are your thoughts on this?

Either a submodule or just actually add the brushes to this repo. Checking out another uncontrolled repo isn't really good practice