Ask HN: Who does OSS security audits?

We have an exceptionally large code base of Java, "R", C++, and Javascript... and are looking to contract with an established vendor to do security audits and ongoing health monitoring. Is there a list of vendors that do this work (hopefully at a discount? funding is always tight).