You download code to run on your computer. You can't audit all of it. So, there is only two non-exclusive options: A- Trust the source or an auditing third par

You download code to run on your computer. You can't audit all of it. So, there is only two non-exclusive options: A- Trust the source or an auditing third party (source signatures, apt, App Store, etc) B- Run it on a sandbox, optionally extended with capabilities explicitly allowed by the user (browser, android, docker, wasm, snap, etc) It seems there is no other way. This also shows how the classic unix permission model is obsolete. I think Wasm has a big role to play here.