I think the threat model the OP is worried about is a three letter agency finding an unintentional bug and keeping it for their own use. He's asking for an audi

I think the threat model the OP is worried about is a three letter agency finding an unintentional bug and keeping it for their own use. He's asking for an audit from someone we can trust to actually turn over the vulnerabilities.