One of the projects I worked on a couple of years ago was audited by Radically Open Security - I was extremely impressed with the quality of their specialists.

One of the projects I worked on a couple of years ago was audited by Radically Open Security - I was extremely impressed with the quality of their specialists. They didn't find anything of course (in the the system I was responsible for) beyond a couple of remarks (which I believe we had already explicitly marked with comments as they were marked for improvement by our static analysis tools; think "you can use a better variable name here" and "this can be simplified by using guard clauses" level). Not bad for something built under extreme circumstances and very little sleep (6-month-old-baby + COVID + crunch + 2 other busy young kids = hell).