If you're not experienced enough to build a secure application, then don't build one. That's what being professional means - not doing work you are unable to execute to a professional standard.

The situation you are in is common. Someone wants work without having an adequate budget. In this case $0. Sure you might work for free. But a busy security professional that could do an audit probably won't.

Making the project open source doesn't mean you will get any help for free. Sure you might. But there are countless open source projects and you are the only programmer who is currently interested in this one. Making it open source isn't going to make anyone else more interested. There isn't an unmet need for projects with non-paying work.

If the app is important to the charity organization, it's fund raisers can raise funds from the usual sources for doing it at a level coming closer to doing it right.

Good luck.