It is simply Prosody + Conversations + Siskin [1], so I'd say that many people have had their eyes on their code.

Specific security audits would have to be searched for, though.

[1]: https://snikket.org/open-source/