I guess GitHub is in a similar bunch of sources, it should be also more efficient to crawl by cloning.
Anyway, isn’t it the whole sales pitch that it generates tailored solutions fast?
The code we've shipped throughout our careers certainly wasn't reviewed only by us. It was reviewed by programmers with more expertise in the relevant area. That's a healthy and efficient division of labor, expertise, and responsibility.
On a tangential point, one thing that should definitely not be possible for apps these days is determining whether you enabled a VPN. AFAIK, it’s possible indirectly in iOS by enumerating network interfaces with specific/telling names.
Whether an arbitrary piece of code can be exploited is obviously undecidable (i.e. it is equivalent to the halting problem). Let me give you an example that will sketch why this is the case: `if(sha(input1)==12345) { run_shell(input2);}`. The real question is how does this look like in practice, for the code that we as humans actually use in our networks.
reply