> There's no guarantees what you're getting even if it's open source, unless you read and understand the source code :)

Obligatory reference to Reflections on trusting trust [1]

[1] https://dl.acm.org/doi/10.1145/358198.358210