I don't know how to audit code. But I can generally get through. For example, I use Aegis for 2FA OTP. How do we know it's secure? Because I can see very clearly that it doesn't have network access on Android and that it hasn't tried to get network access.