io VS Passy

Zero idea since I don't use it, but there's an issue open mentioning exactly that: https://github.com/flathub/io.github.mimbrero.WhatsAppDesktop/issues/7

The flatpak manifest builds the flatpak by downloading and extracting a zipped built binary from github. Even if you reviewed all of the source code, you can't be sure that is what ends up in the flatpak.

The Flathub build was downgraded to 107.0.1 : https://github.com/flathub/io.gitlab.librewolf-community/pull/29

Of course! My flutter app is already distributed on flathub. It's a little bit tricky but you can. Take a look to my app manifest, is pretty simple, if you have some question I'm here!

According to github this may be an upstream issue. I think you'll just have to stick with the CLI.

The manifest looks pretty benign. Its only grabbing two packages. First blueprint-compiler from gnome.org, so thats probably trustworthy. The other is GdmSettings itself, coming from he repository. It doesn't ask for network permissions, so it can't send any data on you out... except that with --talk-name=org.freedesktop.Flatpak it can change the sandbox as it wants if I understand correctly.

sdl2-jstest https://github.com/flathub/io.gitlab.sdl_jstest.sdl2_jstest

The Nheko flatpak is official. Just compare the source to the nightlies we build and upload to our nightly repo.

Passy - cross-platform password manager (version 1.3.1): Offline password manager with cross-platform synchronization

The privacy policy says the passwords are encrypted with AES512 encryption. Unless the Wikipedia article on AES is out of date, there is no 512 bit key size for AES. Something fishy here.