LeftLevel keeps this topic practical: define the trust boundary, make the behavior visible, and avoid promises the project has not earned yet.
The protocol and app should work together so reviewers can test what the website says.
LeftLevel notes
What makes an open-source security project credible?
A credible open-source security project earns trust through testable claims and honest limits.