Sort:  

It's javascript, non-minified, so it's auditable, as it has been before. As I said, no keys are sent so the backend never gets them.
Having a public git repository doesn't mean the same code is used to run the site, that's a false sense of security.

Thanks for clarification! That was exactly the information I was asking for.