Presuming the signed app code is the same as the published source; and of course we can't see the server code.