It would be interesting to read more details about this audit. This blurb is pretty much "Trust us" with more letters.
It would be interesting to read more details about this audit. This blurb is pretty much "Trust us" with more letters.
Ditto, it just basically says "trust us"; no offense to the authors.
Edit: tried to add more clarification to address jtchang's question.
Publicly releasing an audit puts the auditor's reputation on the line. As such, the audit will always be performed very seriously, digging into the code and scrutinizing every possible angle - at a level usually not even remotely done for a private audit.
All said: a private audit means squat all.
About half the companies don't want the audit results going anywhere else. About half are OK with distribution under NDA. In between, there are companies which will negotiate the right to distribute, usually with an explicit indemnity clause, and on the far end are a minority of companies that tell you that the results are work for hire and entirely your prerogative.
The major concern is that the customer will misrepresent the results in some way, or even represent them accurately but then change the underlying service to open up a vulnerability. Either way, nobody really wants to be in the news...