the docs mention an "ongoing third-party audit" and so on. We should replace that by links to the final audit report