If audit hasn't been done and the team are hiding their code it's already a thing to think about. I would just go away from that kind of project, it's no real point of auditing yourself some fishy project