I wouldn't trust them either. I've seen the source via Shared Source and the CSP stuff is missing from it. If it wasn't missing they wouldn't have something to hide.