You're exactly right. The backend source code is here: https://github.com/fivedogit/words-backend but there's no way to know for sure that it's the same code running on the backend other than my word.

Seems like this might be a good business for someone to start, matching a github repository to a running server; third party verification that said code is actually what's running on a server.

If it helps, I made an "about me" page, so I'm not quite a total stranger: http://www.words4chrome.com/team/