Q: Is this a Sparkle (popular non-MAS update framework) insecurity issue? I use the long dead Bodega client to discover and check all local apps for Sparkle up

Q: Is this a Sparkle (popular non-MAS update framework) insecurity issue? I use the long dead Bodega client to discover and check all local apps for Sparkle updates manually. I wish there were a similar app that both checked for updates periodically and checked the security model of each app's update server implementation (it's a difficult problem to audit the client's update security).