I don't think that's a particularly fair reading of the audit. First, they had the audit done at all, which is something a very short list of software products

I don't think that's a particularly fair reading of the audit. First, they had the audit done at all, which is something a very short list of software products can even claim. E.g., and I am not casting aspersions on the project, I don't think `dm-crypt` has done a formal 3rd-party audit to date, and it's probably the next-best alternative to VeraCrypt, not counting the last version of TrueCrypt itself. About the only really unfortunate thing that I saw in the audit was the addition of the old Soviet 64b block cipher that they need to remove. They shouldn't have added that, noble though the goal of adding non-Western-derived algos might have been. But the remainder of the issues noted in the audit are likely there from TrueCrypt, and as the VC team fixes them, it will mean that VeraCrypt is definitively better than TrueCrypt. That's a good piece of information to know, as I suspect there are lots of people around still using TrueCrypt because nobody has really produced anything better yet.