title: Security considerations of `pip --allow-external`
body: <p>What are the security considerations of using <code>--allow-external</code> or <code>--allow-all-externals</code> options of <code>pip</code>?</p>
  
  <p>The documentation sections where these options are described (<a href="http://www.pip-installer.org/en/latest/reference/pip_install.html?install#externally-hosted-files" rel="noreferrer">pip install</a>, <a href="http://www.pip-installer.org/en/latest/reference/pip_wheel.html#cmdoption--allow-external" rel="noreferrer">pip wheel</a>) are very terse and do not explain the dangers of using them. I couldn't also find any resource on the Internet that would do so either.</p>