Yes it is an open source project, but the entire team that works on it is based out in China, and that's really not something you want to play games with.
For tools like this the aim is always to lay low and expand to reach as far as possible, then once you have a lot of control and trust you can abuse it, often you can abuse it without much loss, because once you have institutional momentum it's very hard to screw it up.
You can't operate on If there's a history of abuse of power, only if there is an incentive. I believe there's a very strong incentive in this case.
The fact that itself hosted is actually a really huge concern, because this thing is sitting on your local network with no firewall between it and everything else that you run.
It takes very little to put a vulnerability in a piece of code, and unless you have a person combing every commit with a fine tooth comb, even the fact that it's open source cannot prevent that.
No single security measure is bulletproof. Being open source does not counteract the misaligned incentives.
No offense to anyone and do not want to imply anything nefarious is about but from what I remember Gogs was even worse in that only a single maintainer inside P.R.C had merge access to the main branch. Also a concern because I might remember something about known vulnerabilities having been outstanding on the issue-tracker when the maintainer was busy.
It looks like they got developers from bunch of other locations at least according to their Github activity.
But you are correct, they do get commits from outside of the country
Maybe you could expand on why this is an issue.
The fact that it's open source helps a little bit, but I do not believe they number of eyes on the project is enough that they couldn't sneak something through if they wanted to. This isn't Linux with worldwide attention, it's a relative niche.