There have been cases of sourceforge taking over entire repositories,
e.g. injecting ads into release binaries. This means they may well be
able to push code and tags as well.

Don't remove update checks, but at least don't automatically add builds
for new tags.