Right -- a $10k real audit is a "deal" of some kind -- either a firm trying to win future business with a discount, or an individual doing it directly (especial

Right -- a $10k real audit is a "deal" of some kind -- either a firm trying to win future business with a discount, or an individual doing it directly (especially from overseas, or as a side job). You can also get a better deal if 1) you're open source, and the audit becomes part of someone's portfolio 2) you provide really clear documentation, security model, etc. to make the process more efficient 3) your app is already well-architected so the security-critical part is small, and you only audit that part. There's probably a 100x bigger pool of people capable of doing "IT audits" and "hosting environment audits" well vs. appsec for webapp or mobile app (or especially desktop app).