The good thing about open source is that I don’t have to necessarily do that as there’s a big community behind it. The thing that itches me is that even if I would, I couldn’t be able to in the case of Sync.

To answer your question, not too long ago, and it did not require too much time. I could see what libraries were imported thanks to a tool and decided it was likely not sketchy.