> A few years ago the ReactOS developers had to stop all development for several months to perform a source code audit.

What kind of an audit can you do without access to the original software's source code? How would you tell if it's actually different?