One way to tell if an audit is legit is to look at who did it and what tests they ran. If it's a third-party auditor with a decent reputation and they include things like IP leak tests, DNS leaks, and connection stability, that's a good sign. I'd ask if they've posted the full audit report somewhere public too, so you can see the actual results instead of just taking their word for it.