I've seen projects go as far to claim to have their code audited by simply hosting it on a public github repo.