Sounds like “CommunityAppChecker” utility is needed. Put a CloudronVersions link in input box, utility checks whatever is needed/possible, generate alerts for sus content.
Conceptually best to come from Cloudron team but that drags Cloudron towards approving apps, which is probably a v.bad direction. Maybe I will give some thought to it.
I really understand and support the official stance - it is simply not viable otherwise.
Some other simple defences :
have registered app packager scheme : no fees, basic metadata, probably already publicly known, enough to know legit packager and no more
ca.cloudron.io only takes submissions from registered packagers
Cloudron will hate (understandably) any form of stars or likes on ca.cloudron.io, but maybe a simple more neutral voluntary “I installed this” counter
