Contributors generally include the links to the official sources. If not we track down the official repositories ourselves. Once we have verified the source,

Contributors generally include the links to the official sources. If not we track down the official repositories ourselves. Once we have verified the source, we then check the diff against the submitted and official. We have always flirted with the idea of a level of automation to handle this. But your comment addresses the problem with a solution such as that so we are still manually diff checking for maximum security.