You can check the code for unintentional vulnerabilities, or intentionally added in by a contributor, but you can’t do anything about something intentionally added in later in the process by the person responsible for managing the build and distribution of the application.