$6k covers about 3 days of effort by a single security auditor, which barely scratches the surface for a large application like NextCloud. Sorry, security is expensive :-/.

You can save yourself some headache by using best practices and clearing away all the low hanging fruit before contracting with an expert. For example, but deploying on HHVM, aggressively using static analysis tools and clearing up issues that lead to compiler warnings, and running external application vulnerability scans from things like local Burp Pro or the hosted Tinfoil Security.