I have been reviewing security for unofficial builds, and it's pretty abysmal, same for GPL compliance by the ROM creators. Could you share how you reviewed security for the unofficial ROM?

I'm putting a list of actions to take, but so far it appears it will take days to review ROMS, alternatively download a rom, review what is in it and build from Lineage official source, with Lineage having the better privacy record ....

Some things I would need to check:

- The binary blobs at least match the originals, for example binaries from xiaomi

- Included applications that DO publish their source match the published source / binaries built from said source

- Permissions are sane/correct and don't have too many 777 where it is not needed, which is often set for convenience during development

- That developers are aware and transparent about any telemetry or spyware, which appears to receive a rather cavalier approach from many developers.

This is just one example of developer hostility and incompetence on the xiaomi eu rom community when asked about spyware: https://xiaomi.eu/community/threads/why-does-xiaomi-eu-rom-t...

There are many more to be found at the XDA forum, under custom roms.

There are also some older discussions on HN, xiaomi related, but it does bring up the larger point - how many of the applications and core functionality in custom roms is spyware ? https://news.ycombinator.com/item?id=26306661