get it again maybe ... these apps host/serve this source code from github.com but we can "trust" it through our follow list (so to speak)
Discussion
Download nostr:npub10r8xl2njyepcw2zwv3a6dyufj4e4ajx86hz6v4ehu4gnpupxxp7stjt2p8 and see for yourself nostr:npub145dzzcseavt770mvc2xz3rvxh5w5znh3qcj8tkm3dw638m5pgwsq5q9etj
will do ... thanks for your insight! :-)
The app could be hosted from just about anywhere. GitHub, a Blossom 🌸 server, or whatever, and signed with a PGP key or nsec when listing it on zap.store, and your web of trust on Nostr can be used as a measurement of the trustworthiness of that key.