This is my biggest fear - that my password app is hacked. What if the real LastPass (or KeePass, or whatever) dev had a gun held to his head to add code to upl

This is my biggest fear - that my password app is hacked. What if the real LastPass (or KeePass, or whatever) dev had a gun held to his head to add code to upload credentials to somewhere, and then signs and uploads the legitimate app. Open source doesn’t help - dev just doesn’t check in the changes. Reproducible builds and open source help in theory, but how many people go to that length if it’s even possible? I don’t.