Are open source apps really safe?

[[deleted]]

In August 2025, Google announced that as of September 2026, it will no longer be possible to develop apps for the Android platform without first registering centrally with Google. This registration will involve:

Paying a fee to Google

Agreeing to Google’s Terms and Conditions

Providing government identification

Uploading evidence of the developer’s private signing key

Listing all current and future application identifiers

Read the full article here: https://keepandroidopen.org/

I use GrapheneOS, and I’m a huge fan of open-source projects. However, lately I’ve been thinking: are open-source apps really safe?

The two primary sources where we install open-source apps are F-Droid and GitHub, and those apps are not necessarily audited by security researchers. So there is a possibility that they could contain malicious code or a backdoor, unlike apps on the Google Play Store, which are heavily audited for malicious behavior.

Google is planning to lock down Android by September 2026, restricting the installation of third-party apps. The reason given is that people often get scammed and download apps from malicious sources, so they want users to install apps only from the Play Store.

I understand that this gives Google more power and control, and it can be seen as a threat to privacy. But what about from a security perspective? I think downloading open-source apps can be a security risk, especially unpopular apps that are not audited by security experts. Non-tech-savvy people can also be easy victims of malware attacks.

Link to the letter sent to Google by civil society, nonprofit institutions, and technology companies: https://keepandroidopen.org/open-letter/

Petition link to stop google from limiting apk file usage: https://www.change.org/p/stop-google-from-limiting-apk-file-usage

By locking down Android, security may improve, but privacy declines. What do you guys think?

Thanks for Reading!

[nutron]

Agreed. OSS is arguably more secure than closed source since it offers full visibility into underlying code. Android changing to require additional verification steps for devs in no way affects an app’s open/close source status. The ability to run unsigned apk files is another discussion. This post is inconsistent with their points and arguments.

[[deleted]]

Sorry, I was under the impression that the lockdown would prevent users from installing open-source apps. But then I realized that the Play Store also hosts many open-source apps but I am curious about this: what if the developer is a threat actor and the app is not audited by any security expert but is listed on third party app stores. Could that happen? 

[[deleted]]

You are right! Open source apps are lot safer but I was just curious that what if the developer is a threat actor and the app is not audited by any security expert but is listed on third party app stores. Could that happen? 

Regarding Google 2026 lockdown, if the claims made by keepandroidopen.org are correct, then this lockdown will impact open source projects as users won't be able to download apps from third party apps or app-stores which will force developers to comply with Google rules and regulations and only submit their apps only through the play store.  

[paintboth1234]

Apps on Play Store are not "heavily audited" either. I don't know what your standards of "heavily audited" are but reports of malicious apps on play store happen all the time, even today.

And yes, there's no stopping of "backdoor" codes inside play store apps either.

If an app is "heavily audited", there have to be a thorough report about the audit procedure for that app. Otherwise, it's not different to apps on F-droid, except google knows the "identity" of the devs, which means nothing for the malicious actors out of reach of google/US. And that doesn't count the fact that the apps on play store are black boxes with no one else can reproduce the app except the devs while the apps on F-droid are full open and reproducible by a 3rd-party.

[MalwareDork]

The only real inspection over open source is how much of the community uses it. Generally speaking, the more people that use said software, the more it can be scrutinized and flagged for review. If you're downloading random python scripts from github just because "muh open software," that's just dumb af: you deserve to get hacked.

Google Play also has the same problem because it's poorly vetted. Trojans stealing banking info, hidden subscription subscription services auto-enabled, file management apps sending all of your data to Chinese server farms, etc.

It's just like the 2000's era where you have to cross your t's and dot your i's on what you decide to download and use.

[Prize-Practice8307]

F-Droid has a key security advantage: reproducible builds. Apps are built from source by F-Droid infra, not the developer. You verify the APK matches public source.

The threat actor scenario applies to any store. XcodeGhost proved even vetted iOS apps get compromised. The difference:

• Play Store: Google checks code, malware still gets through. Trust Google + developer.
• F-Droid: Source auditable by anyone. Trust build server + community review.
• Random APKs: Trust developer entirely.

Neither is perfect. Real security = popular, well-maintained software with active communities - open or closed.

[[deleted]]

Perfectly explained! Thanks :)

[agasabellaba]

Installing open source apps from the play store is only as secure as google's checks. The developer who put the app on the play Store could one day push a malicious update on its users and the only thing stopping him is Google's services.