Wow, can I ask was it a big stack? And when you say audited, do you mean manual code review, static analysis or something else? How far down the stack did it go?

I'd be genuinely interested to hear, as it's something I see bandied around a lot but extremely rarely followed through on as code reviewing a modern stack is a huge proposition, and manual code review is very expensive/time consuming.