Same here.

• on the phone I trust F-droid that they have some basic checks
• I either avoid very small projects or I rifle through the code very fast to see if its calling/pinging something suspicious.