[dlcarrier]

I just download it from the repository. That's not am option on iOS, which is one of many anti-features.

[aqueueaqueue]

If the threat vector is the code owner is lying that their app is the same code as the repo, even downloading artefacts from that same report is risky. Even the code itself should be manually read and verified.