Link: https://old.reddit.com/r/fossdroid/comments/1v03a70/how_do_you_securely_vet_and_review_foss_software/

This is an automated archive made by the Lemmit Bot.

The original was posted on /r/fossdroid by /u/Evening-Dog-1046 on 2026-07-18 18:21:50+00:00.

I have a small list of well recognized apps that I deploy on a GrapheneOS phone. I know to vet APK signing cert fingerprints and if necessary (such as w/ F-Droid, although I don't prefer F-Droid) to verify and validate PGP signing certs.

I use Obtainium, and I prefer to pull most of my apps from GitHub pages. I see that many GitHub pages have verified user status, and I would naturally assume that that is a solid method to vet the account I'm pulling applications from. I know safe review of GitHub pages would include reviewing the number of followers/watchers/Stars(?), but I don't know what the magic number for followers/stars is to consider a download safe.

Other than that, basic common sense such as: verifying the domain (in the few instances I pull from a non-GitHub source) registrant, verifying HTTPS certs as possible, uploading the APK to VirusTotal or HybridAnalysis, and generally trying to lean on only more publicly known apps and their distribution sites (e.g. a YouTuber w/ a good follower base, popular GrapheneOS forum posts, etc).

1. Are there newbie friendly steps to reviewing the APK code, or build, to verify the app is safe?
2. What other steps could I incorporate into my overall review processes?
3. What are my current steps missing?

*******************************************************************

Follow up below (but expect staggered updates, and I will keep you all updated). Major shout out to another user on another post on r/GrapheneOS who advised me to check this stuff out:

https://privacyguides.github.io/verified-apps/ <-- This is a more up-to-date version of AppVerifier by SoupSlurpr. This immediately found all of my apps, and I was able to validate cert fingerprints for everything I had. While this doesn't constitute study of the apps themselves; it did provide me with at least a semblance of security as others have apparently looked at and reviewed these apps (to whatever extent..).

https://github.com/privacyguides/verified-apps-android/releases/tag/26.6.14 <-- See here for the PrivacyGuide VerifiedApps download. Looks to be a more expansive AppVerifier, as I stated above. This may give you a slight bit more confidence when pulling an app, as at least you know someone else has looked at it... Know that it's not just a site to validate on your workstation, rather it is an application in-and-of itself.

Overall, still looking at how to review apps.