Start with who built it. An official server from the service itself removes more risk than any other single check.