There's a bit of circular logic here because I can't evaluate who to trust if I can't effectively monitor what the developer is doing on my machine.