[JaggedNZ]

I've had audits like that, many are just for CYA and I'm often the dev patching obscure (or not so obscure) security issues.

Honestly, I'm quite happy to have an auditor nitpick a few non-issues if the alternative is risking releasing an app that has a basic sql injection attack that wiggled past code review due to code complexity.

I've also had an external audit that found an unreported security issue in a new part of a widely used framework, so there are auditors out there that do a good job of finding legitimate things.