Is it open source? How do we know it is not doing something nefarious?