It doesn't even have to be there... The main reasons to clone a repo are because you're about to compile and run the code there, or you already have and need to

It doesn't even have to be there... The main reasons to clone a repo are because you're about to compile and run the code there, or you already have and need to fix something. I don't personally audit all the code I run, but I hope someone is doing it. That being said, source code being public is much better than the alternative of just downloading binaries from who knows where. I don't trust anything absolutely, and I don't see a way past it.