just my 2 cents, but showing the source to a limited amount of people, who are themselves known for other kind of work and certifying that your app isn't badly

just my 2 cents, but showing the source to a limited amount of people, who are themselves known for other kind of work and certifying that your app isn't badly behaving could be a good start. That's not a silver bullet idea though, because it requires trusted voluntary (or not) people and there is always a slight risk of source code leak.