[upofadown]

It appears the audit was applied to the Android and iOS apps. So no comment is being made here about the security of the webapp.

[sodality2]

I thought that was just a wrapper around the website, to be honest. But regardless, the app still loads JS from the website and executes it, so it's still a backdoor possibility.