https://privsec.dev/posts/android/f-droid-security-issues/, the recent findings of bypass of certificate pinning [0], wireguard creator doesn't trust f-droid himself [1], continued harmful attacks to GrapheneOS devs [2] and a few more points regarding their build infra using a deprecated debian release.

[0] https://www.openwall.com/lists/oss-security/2024/04/08/8

[1] https://gitlab.com/fdroid/fdroiddata/-/issues/3110#note_1613...

[2] https://gitlab.com/ironfox-oss/IronFox/-/issues/7#note_22877...

The handling of the project appears quite troubling, the whole board resigned last year: https://gitlab.com/fdroid/admin/-/issues/447