Personally when I install some software I generally look at popularity (like stars if the code is hosted on Github), whether an audit has recently happened, it is recommended by someone I trust, and whether the permissions it needs are reasonable (I’m on Silverblue so I only install Flatpaks)

When I used to use Arch I also looked at the pkgbuild beforehand since they’re generally fairly small en very human readable. I also looked at popularity there and whether the developer maintained an Arch package. But that obviously doesn’t say anything about the code itself.

I definitely don’t consider myself non-techy since I’m doing an an engineering masters with a CS track but those things shouldn’t require any programming knowledge.

But I think most of the more common users don’t really care and install the packages they need without thinking too much about it. Unless the source seems very untrustworthy.

Edit: you can never truly be certain that a project’s code is safe. You can only have soft guarantees. Albeit some like formal verification are harder than others like project popularity.

I personally like Cryptpad. It can be self hosted, but you can also make an acount elsewhere considering you don’t want the hastle of maintaining.

Overleaf can be self hosted too