All you need to verify an AUR package is to read the PKGBUILD file, which is something the AUR keeps on encouraging you to do (this assumes that you trust the upstream repo, which is something that even official packagers of most distros do)
Also a lot of flatpak packages aren’t sand boxed enough to be safe and only ends up giving false sense of security to nontechnical users
Your last point is extremely important though, AUR is horrible for nontechnical users (which is why the AUR discourages AUR helpers)
All you need to verify an AUR package is to read the PKGBUILD file, which is something the AUR keeps on encouraging you to do (this assumes that you trust the upstream repo, which is something that even official packagers of most distros do)
Also a lot of flatpak packages aren’t sand boxed enough to be safe and only ends up giving false sense of security to nontechnical users
Your last point is extremely important though, AUR is horrible for nontechnical users (which is why the AUR discourages AUR helpers)
Okay having an easily readable build file is a bit missing. Flathub hides that a lot.
I think their rating system, which is on the website and also GNOME Software, displays apps with
homeaccess as insecure.And somehow this seems to be general knowledge and an issue about a privilege escalation through a local override was just closed. Yay