I'm Open Sourcing the Have I Been Pwned Code Base
Very naive question. Suppose I offer a service (e.g. Have I Been Pwned) and I want my users to trust my service not to store/share their data. I understand that open sourcing the code base is one step, but how can I know that the server running the service actually does run this codebase and not something else?