It's exactly this. A private audit is generally cheap. The truth with these is that the audit really doesn't mean anything - you will often find such audits per

It's exactly this. A private audit is generally cheap. The truth with these is that the audit really doesn't mean anything - you will often find such audits performing such a superficial sweep of the software that even glaring problems may not be found. Publicly releasing an audit puts the auditor's reputation on the line. As such, the audit will always be performed very seriously, digging into the code and scrutinizing every possible angle - at a level usually not even remotely done for a private audit. All said: a private audit means squat all.