I think starting small would work better.
Let 1-2 people within the community review the code.
It’s quicker + cheaper this way.
Later on we could move to more trusted code auditors once the community grows.
All we’re looking for is:
- Have they done anything or just forked a bunch of repos?
- What they have done, is it good in terms of code quality? (clean + commented vs excessively long + unclear what the code does)
The latter is fine if it’s a hackathon project, but if they’re looking for large amounts of funding ($250k+), they need to at least demonstrate they can write good clean code beforehand.
Again, this is more of a rating of trust than a rating of ‘how goods this project’, so maybe it doesnt matter what the code quality is and more that the team can write their own code and haven’t just forked something over and changed some CSS and are now peddling it as theirs.