These has been a security audit, ordered by the french ANSSI (French government IT Security agency). This audit resulted in a "CSPN" certificate, which basically means that 35 days were spent by a competent auditor (Thales), and no important vulnerabilities were found in KeePass 2.0 Portable.
paper (in french): https://www.sstic.org/media/SSTIC2015/SSTIC-actes/injection_... video (in french): http://static.sstic.org/videos2015/SSTIC_2015-06-03_P09_AGRE...