Theoretically, if you audit the source then you only really need to care about updates to the actual code. If it doesn't do silent updates then it can't change

Theoretically, if you audit the source then you only really need to care about updates to the actual code. If it doesn't do silent updates then it can't change underneath you, even if it does some kind of network operations. Its not fool proof, but it feels better than a black box that could be a different black box tomorrow or after the next acquisition or round of investment.