[abecedarius]

Besides what's been suggested already, there are many small open source programs that have never had an audit. You could follow the example of defuse.ca and just start doing it.