Embed Notice

@aaribaud @SylvieLorxu @ploum @LenticularCloud

"The actual risk scenario would be that a github repo owner build an APK from sources other than those on the repo and upload it to the repo"

That indeed is a real risk as I have no means to check that. There are other checks in place (library scanner, VT etc) which should reduce the risk of "bad stuff" – but a little risk always exists. So you need to trust the developer, too…