Being open source by default doesn’t make a project secure and privacy friendly (especially if it’s server sided code. You can’t really verify for sure)
Imagine you didn’t even heard about google, but some of your colleague/friend use Google contact synching (which is very default these days) And ta da! Google knows your name and number with 99% percent of accuracy.
Being open source by default doesn’t make a project secure and privacy friendly (especially if it’s server sided code. You can’t really verify for sure)