Open source is the only way to verify. If it's closed, it's compromised. Simple as that.