Ah yes, review the PKGBUILD for every AUR update. Luckily I do this while I'm rereading the ToS every time those get changed for all my software as well.

When I finish that I intend to read the changelog in git for each of the commits since the last update.