The only reason I'm limiting headings is to have some sense of uniformity. I'll make the changes to the "Themes" category, and I'll add an events category. I suppose I'll add a "miscellaneous" too for anything that doesn't fit.
For private repositories, I'm planning on adding the ability for Glass to mirror it. I want to rework the updates so that only "verified safe" add-ons get pushed to the updater, so that there's protection again someone spontaneously putting a backdoor in and pushing their add-on. However, I'll have Glass act like a client to the updater system and check the "parent" repository to automatically register an update, rescan the file, and reset the safety rating. The first iteration of the system will probably be JSON-only, and then I'll work on a PHP TML interpreter.