They can't. The only way to be certain is to take that code and build the app yourself. If you're downloading prebuilt binary, you have to trust that the author

They can't. The only way to be certain is to take that code and build the app yourself. If you're downloading prebuilt binary, you have to trust that the author is correctly representing what it was built from. This is even more true with SaaS, because the binaries used there can and do change without warning.