Stuff from the repository of your distribution generally can be considered save but everything involving a third party might not be.

This counts for both other Apt repositories as well as Flatpak. You likely have Flathub as an Flatpak source and while they have some checks and controll instances it is possible for untrusted third parties to upload packages including non-free ones there. I do not now of any incidents but some suspicion for packages with full system access can't harm.

Discover itself doesn't care about security - it's the underlying package manager(s) that do.

Flatpak is perfectly safe IMO, as are the built-in repositories.

Both Flatpak reviewers and Debian maintaniers do their due diligence when auditing the software they distribute.

When using distros/repos which are less FOSS purist (such as Ubuntu), you could run primarily into privacy issues. When using smaller ones, the risk of a backdoor or voulnerability is a bit larger, as less eyes are on the code.

That being said, the only way to be immune to untargeted cyberattacks is to be offline, which isn't reasonable in this day and age. As long as you stick to your distro's repo and Flatpak you should be perfectly fine, save for the "normal" voulnerability or two that unfortunately slip through every now and then. You could think of this as a kind of digital "herd immunity".

As long as you don't add repos willy-nilly but think about who you trust, you should be fine.

So yeah - you can assume Flatpaks and the Debian repos are safe. They have good security policies about adding stuff in and do do their due dilligence. Though, this might change in the future, alrhough it doesn't seem likely. But for now - you'll be fine.

The only real risk is if a backdoor like the recent one in xz-utils does slip through the cracks, but then you'll be one of millions of affected machines which, while not mitigating the vulnerabilities per se will at least mean the problem will get fixed sooner once it does get found.

Just to clarify what others are saying: the 'software store' (Discover in your case) is just the graphical application that you use to manage the software installed on your computer. The repositories, aka 'repos' are the sources of that software. There are people whose job it is to vet the software in those repositories and make sure that it's safe. Flatpak is a packaging format. The biggest repository (and what you likely have enabled) for flatpaks is Flathub. If you're installing software from the Debian repo and Flathub you should be fine. You should be able to verify which repositories are enabled via the Discover app. You have the freedom to add other repositories too, but it will be your own responsibility to evaluate whether those sources are trustworthy if you do.

Long story short, if you just use Debian as it is, you are fine.

Uhhhhhhhh…

Bruh. It’s not safe to assume any software from anywhere is safe… that’s kinda the essence of Zero Day exploits.

Even if you wrote it there have been Linux exploits that hid a root kit, and patched the gcc compiler and linker to create a level of persistence that is just other worldly. IIRC what that fucker was called, but it won’t be hard to find. You can probably still count Linux root kits on one hand.

Hell, I’ll look it up after I’m done with my morning duce… that shit was epic. And like, also, theoretically, you could be Mr. Robot, so… you know… it’s just a good idea not to trust yourself anyway.