I'm supposed to just blindly boot it up on my computer, with the license explicitly banning decompiling and disassembling the code, so it could sensibly reviewed?

Can you see why I'd be concerned about that?

you can run it in a virtual machine. All the code is written in javascript, and you can study it without even decompiling it.