Good question. Only thing should check for us security. Who is running the project?
Is nostr:nprofile1qqs83nn04fezvsu89p8xg7axjwye2u67errat3dx2um725fs7qnrqlgzqtdq0 reviewing or checking authenticity?
Discussion
Zapstore pulls APKs from different sources, mostly Github. We calculate hashes and when users install an app, they download it from the original location.
We do NOT build and host like F-Droid.
DVMs checking for security and privacy (and reproducible builds) are coming.
The project is run by nostr:nprofile1qqs8y6s7ycwvv36xwn5zsh3e2xemkyumaxnh85dv7jwus6xmscdpcygprpmhxue69uhkv6tvw3jhytnwdaehgu3wwa5kuef0ekucf3