Software we build depends on an aweful lot of other software, our framework (Drupal), third party modules, libraries (server side and client side!), PHP and it's extensions, Webserver (Nginx / Apache), OS (Linux), etc.
The question with security audits is always, how far do we go? What third party software should and shouldn't we audit?
For an application that uses Drupal, it's pretty clear that we should audit the custom configuration and code as well as verify that all third party library versions used do not contain known vulnerabilities. But should we audit Drupal? Should we audit a popular third party module like Views? How about a less popular one like the Feeds REGEX Parser? What if a Alpha, Beta or Devel version is used?
To help with decision making we built and released the Ibuildings Drupal Security Audit tools.