The developer doesn't have a public facing repository and instead just dumps the source code for each new version - making it really difficult to see what has a

The developer doesn't have a public facing repository and instead just dumps the source code for each new version - making it really difficult to see what has actually changed. You can see the commit activity for KeePassX, which would make it more obvious if a bug or malicious snippet might get inserted into it.