I agree that the best approach would be to pay for a security audit, however, (at least in my case) if the project is a small open-source project, most likely there isn't a (any) budget for multi-thousand $ audits.

Thus I was hoping to identify some welcoming mailing lists or forums.