Decompiling the program is arduous but it is possible. You only need one person to do it and expose the nefarious activity to destroy their reputation, which ac

Decompiling the program is arduous but it is possible. You only need one person to do it and expose the nefarious activity to destroy their reputation, which acts as a deterrent. Another option is to restrict its network activity. If it can't communicate with the developer then it can't send your information to them. You could also merely log its network activity, maybe using some hooks into any crypto library it links against so you can see the plaintext. That wouldn't prevent it from doing something bad, but it would at least allow you to detect it after the fact and then everyone would know to stop trusting that developer, and you get the deterrent without investing as much time and effort.