I don't understand why you'd be making this comment when the commit history shows this whole project is a week old.

>how do we know it won't be sent elsewhere?how do we know it won't be sent elsewhere?

I the past open source meant that you trusted in theory that someone else would notice and report these things. These days though just load up your LLM of choice and ask it to do a security audit. There are some unreliable ways to cheat this and they aren't magical, but it would be pretty hard to subvert this kind of audit.

It is usual for a new project to start small, and slowly add new features. Instead this project seems to arrive "fully formed".

There is no "this is the core, then we add S3, then we add RDS, then we add ..." history to view and that seems both unnatural and surprising. Over half the commits are messing around with github actions and documentations.