Gregory's Serverhttps://hex-rays.com/ida-free/
is the only product I've used for this type of work. I generally don't do much reverse engineering though as I find it annoyingly tedious.
One thought; if you know the original source repo of the binary files, you can compare the hash of the compiled files from the authoritative source to see if they've been modified / recompiled before uploading to Ventoy's repo.