Well - since it's open source, theoretically you can build it yourself and "trust but verify" the audit, although there we're also assuming you trust your own judgement or that of your security team.