Are there security standards for each stage of a module on Drupal.org?
Create sandbox project > full project with dev version only > official release
What is the process for the security of contrib modules? Do audits happen?
Historically, I have functionality rather than security on my mind when selecting a contrib module. Partly because I don't know how to easily evaluate security (that is, without studying the entire code). How can I evaluate how secure a contrib module is?
Currently there is no correlation between project status and presumed security of code. From The Security Team Handbook page
in general the team does not review core nor contributed code
The Drupal security team works to resolve vulnerabilities that others find. Any review that happens to sandbox modules would be part of normal project review (no guarantees). When code is explicitly reviewed for security, it is most likely because someone was hired to review it.
In general, you can use the Writing Secure Code guide as a starting point. Also checkout presentations from Cons and Camps.
