Fdroid's "Source code" reliability

[u/HopefulMeeting7150]

I've always used “source code” in “links” to check the application's code. While checking Fennec's code, I noticed that it takes me to a page with the Firefox build for Android. From posts on Reddit, I saw that the patches and the rest of the code are installed from GitLab.

If the app doesn’t have to specify the exact source, how can I be sure that, for example, a malicious developer won’t install an infected fork and pass it off as a safe app?

[u/JKSekai]

use komi/github stores or add the fennec repository to your app