For starters, for most applications there is no feedback because they are not popular enough for somebody to care to take a close look and publish results. Also

For starters, for most applications there is no feedback because they are not popular enough for somebody to care to take a close look and publish results. Also, details regarding security are not usually made available for public which does not help. The protocol I worked on is used to bootstrap security for credit card terminals used for hundreds of millions of transactions and yet about 2 people ever looked at it really closely (my boss and another colleague mathematician). For some applications you might get an outside opinion (audit or certification) but these are not typically aimed at checking if you did your job well, rather they check if you meet some kind of requirements. For PCI, for example, there is a questionnaire. Also the feedback of this kind comes for really egregious mistakes, but the devil is usually in the details.