Also interested in knowing whether a professional security audit was done and if there is a public security pentesting program. This is especially important given the blast radius of an authentication service.

We are always looking for security experts to review the code and to pen test the application. Please hammer it and let us know at privacy@fossorial.io if there are any issues!

As the project grows and we have more resources to spend we will try to work with some professional service to take a look for sure.

Im sure if there was an audit, it would say so