[danielheath]

Sure. My point was more that - at least on android - you can compare decompiled binaries with the open source implementation, presumably making it reasonably likely that it’d be noticed and reported on.

[wizzwizz4]

Unless they decline to publish their source code for over a year, again. https://github.com/signalapp/Signal-Android/issues/11101