https://www.eff.org/deeplinks/2014/11/what-makes-good-security-audit