Also interested in knowing whether a professional security audit was done and if there is a public security pentesting program. This is especially important given the blast radius of an authentication service.
As the project grows and we have more resources to spend we will try to work with some professional service to take a look for sure.