Security Audits Audits: How, What, and When? Penetration Testing vs Code Audits Data Retention, Logging, and Deletion