Wherever the app’s code is on. I usually go around finding the link in the store page or through the search engine. Most of the time, they end up on GitHub and GitLab, sometimes on Codeberg or other instance.

Paranoid section ahead: Don’t blindly trust the issues list, closed or open, because there are still ways to permanently delete those, hence giving bad actor a way to hide evidence of the on-going security problem.

I look at the latest release date. At leisure time, I would also go and check repository and issue tracker to see whether something serious is being ignored. If it’s crucial for business, I would spare time investigating the source code itself.

I would not necessarily say that many apps uploaded to F-Droid and other repositories are unsafe, because I don’t have all that energy to audit anything I use. What helps me to stay on the safe side is reading into things - enclosed descriptions and names may look like a small factor to some, once they tread the sources, but it saves me both the time and trouble. Sloppily written stuff usually implies a sloppy code, a lax attention to details on the developer’s side.

Previous owner of Godot Community Forums got burned out and didn’t curate the first month of co-owning this platform - here we have a clear-cut case study against prematurely transferring ownership. One could look at it and think that Cybereality took over the forums only to sabotage them in a few weeks. But it might be a rather spontaneous product of zir heated discussion and disagreement with Juan, so I’d write this off to a “happy” coincidence. Cybereality already explained it’s about confusion around allegedly broken promises with W4 and Godot Foundation.

Looking at the bigger picture, it’s a case study of problems with centralization of community in confines of something close to walled garden, around the project that is supposed to be as open as a vocabulary. More the reason to raise awareness of Lemmy communities, Matrix Public Archive, etc.