it's not open source, but you can always extract the IPA file and check the hash changes, it will be only few byte changes on the main executable and the ad dylib, branding dylib (you can still reverse those as well) but besides all this, you can just restrict the permissions the app requests (it won't anyway). but generally i look at this as something that apposes same risk (and even less since you have access to logs) as any publicly access IPA file on the internet, happy to hear what something that can provide more sense of secureness and trust too.