Actually zap.store fetches most apps from Github. But with additional security guards (checking hashes signed by the dev), web of trust display and better discovery. And soon zaps. Obviously Github directly has way more apps, but we're getting there.