In reply to Terence.

It looks like Automattic will be conducting its own audit, separate from this effort. Matt mentioned it in the Gutenberg FAQ post he published yesterday.