how a bootstrapped dapp approaches security

poidh, a three-month-old bootstrapped dapp with fewer than 100 users, states it has not performed a formal audit and that users may be at risk when depositing ETH or interacting with its contract until one is completed. The team says its single Arbitrum smart contract was coded by co-founder J, who has 5 years of crypto experience and reports 0 critical vulnerabilities across 50+ contracts. The contract is not upgradable, and bounties are controlled solely by their creators. An automated scan with Audit Wizard's Slither tool found no obvious critical vulnerabilities, though the team acknowledges medium- and lower-level findings, and plans a V2 contract without a set timeline.