It's on f-droid with reproducible builds.

Obviously there's a risk that the person scanning the QR code does shady things with it but it's rather unlikely the app itself will. It would be caught really quickly.