I'm really new to this ecosystem, but isn't that done if you build a package/binary (with PKGBUILD)?

Did some searches

https://github.com/LuigiD5555/aur_scanner

https://gorkaegino.com/garden/how-to-inspect-aur-packages/

I guess we need to verify this stuff ourselves. Good to know.