Kinda pissed at @tootdon right now for not disclosing that they forward public toots to an indexing serving, because I would’ve wanted to know that (and to disable it).
But the immediate reaction of “use open source lol”: did you personally compile it? If not, you’re no better off. You’re trusting the app packager to compile only the code in the public repo.
And for that matter, do you trust that your instance admin isn’t doing the same?