My experience with Russian sourced software is to treat it as low trust, like I do everywhere else, until proved otherwise. An example is gitflic.ru. I'm cautious about it but can see a number of developers moved there after being thrown of MS's Github so a very legitimate reason to use it. Is potential Russian surveillance any worse than the government of the country in which you live? Probably not.