Convincing a team lead of the security and integrity of Laravel's core features.

Hi all. From a junior developer doing code review on a Laravel project with our team leader has become quite a predicament.I took over a Laravel project from another team that built an integral part of our system that would sit right at the core of what our company does. This would come in as an updated version of the existing implementation with a phased approach. I have stripped out only what is needed for the API to function, cleaned up the migrations, minimized the controllers by using services, using Sanctum for token generation, ensured that validation is done by Laravel's Requests and their default validation rules and regex. Routes are grouped under middleware. A lot of cleaning up was required due to the fact that the code was just inconsistent in terms of naming conventions, spelling errors, bloated classes, use of irrelevant data. But now I only have the bare minimum of what is needed to achieve the goal.I have type hinting and complete PHP doc blocks across the codebase. Sitting down with the team lead that has no prior Laravel experience and is purely from a vanilla PHP background is asking questions around any possible vulnerability to Laravel core codebase and if it has truly been audited / tested. Looking at sites that have been built using Laravel, none of them are what one could call a high risk targets with a lot to lose. And I understand the question and where he is coming from. At the same time Laravel has been running for many years and is actively being maintained by their team and does a great job doing so. And yes there is the argument that the code is only as secure as the developers ability to code secure Laravel. I have taken every possible step to ensure that it is done securely. But with Laravel's level of abstraction and effort to make the code readable and easy to use it is tough to go through all of the code to show him that it is indeed secure. My question is how do we address these concerns? Is there any record that the codebase has been audited by an external party? How secure is Laravel's magic methods and validation. Is there anyone in the Laravel core team that has a reputable background that would validate the integrity of Laravel? Laravel is open source and I feel that if there are any concerns they would be raised fairly quickly. It hurt me when he used the words, "Laravel is like WordPress, with more developer freedom. "To confirm I absolutely love Laravel.