I don’t code so I can’t possibly audit FOSS software. However, I also can’t audit proprietary software. Lots of people can and do audit FOSS software, though, and can and do share their findings. But no matter how many people “audit” propietary software, it remains propietary - a black box. Untrustable, especially considering corporations’ incentives and historical actions.

Why are you sharing a product/service that’s in maintenance mode? From the README:

Trilium is in maintenance mode - see details in #4620

I recommend TriliumNext Notes, a current and active fork.

I used vaultwarden just the other day for this purpose. I mean, I use vaultwarden daily as a password manager, but it also has secure file transfer.