F-Droid is doing their “Suspicious or Unwanted Software Signatures” automated scanning season Blog . It’s basically an automated checking mechanism to check if apps haven’t added unwnated elements.
From Gitlab documentation :
code_signatures
A list of (python) regular expressions. Binaries (e.g. APK files) will be scanned for these signatures.
example:
code_signatures:
- com/demo/analytics
I do think that the fact that F-Droid is very strict on inclusion criteria is good. Versus Github where you* have no idea if the app is private.
*Except if you have substantial skills and time.