Yes, I will probably open source it soon. But couldn't one just open source the code, say that's the code the app is using, and then change the code the app is using to do something malicious? As long as I don't check in the new code, no one would be the wiser.
Not that I'm planning to do that, but is there a solution to this issue?
You could build my source and deploy to your system yourself and it would work, but this doesn't seem like a very "for the masses" solution. Plenty of people out there who want the security of using open source code that others have reviewed, but don't know anything about development to be able to build that code themselves.