You could, but now you're just forcing the attackers to fork an existing project and push some nonsense code to it before they can attack.

Why would you want to cut off all people that use only the web front-end?