When it comes to iOS, Here’s a cool guide for reverse engineering .ipas. github.com/ivRodriguezCA/RE-iOS-Apps . I would think applying a sort of comparison of the static analysis with a published app against the compiled repos version would be a possible first step