This particular line in the developer's response[1] leads me to believe they don't - or at least don't properly - validate third party dependency changes, which is even more worrying if I'm honest:
> I will look into why Sentry.io is being contacted so often! This is strange as unless they changed their SDK/framework, is only supposed to happen on a crash report.
1: https://github.com/objective-see/LuLu/issues/488#issuecommen...