Nobody is auditing the code. We find out when a dev stumbles upon a bug through sheer luck.