You'll have a hard time gathering a small circle of people willing to state, for the record, "We reviewed the code and the invisible bug doesn't exist." Personally, I would want no part in an audit like that.
For a concrete threat, yeah, you fix it first. But the thing about scandals is that delay only incubates a bigger scandal.
