Hacker News Reader

What makes you think this was the first audit? Shipping a bug doesn't imply that zero QA was done.

I assume they do that sort of thing, but something was missed.

So you find out why you missed it, and do it again to look for anything else that may have been missed the same way.

They probably did do this in the first place. But products change over time, so they need to keep doing them.