We do not pre-emptively audit, but we formally audit code following a bug report