It’s possible in theory, hard in practice. You can, for example, look if they have any repo with their fork (if they forked) or mirror (if just mirrored for one reason or another). Well, that’s the easy part. But even if so, you could think that you can’t know if the code in the repo is the same as the running one. But that’s not always true, as for example if the code has reproducibility guarantees; just like in F-Droid, or in Nix, or in Guix. There are projects that make it more localized, at the application level, publishing everything from the compilation recipes along with their scripts and DBOM, to their default configurations. If they claim that the program they are running follows just those structures but you cannot reproduce it when compiling or self-hosting, you may become suspicious. Of course, divergence adds another problem here, and the method is not perfect either since it depends on there being a certain initial assertion to test against your evidence, but it is much better than nothing. And I don’t know in any case why you would join an instance that claims to be reproducible but does not give access to its code or one that gives access to non-reproducible code.