I've been asking for security audits as I go. It's not perfect but it's something. And it picks up the most obvious stuff.