Vibe code audit and hardening
You got it this far with Cursor, Claude Code, Replit, or Lovable. Now an engineer with 30 years of experience will review your code, explain what’s wrong in plain English, and fix it, so you can trust it with real customers.
Reuven Lerner · MIT, PhD · O’Reilly and Manning author
Sound familiar?
Vibe coding is a smart way to get started. It’s also easy to end up with an app you’re nervous to launch, show investors, or hand to customers.
These are reasonable questions, and you deserve straight answers. That’s what a code review from an experienced human using modern tools gives you.
How it works
Give me access to a private GitHub or GitLab repository, or send a zip file. I’ll sign an NDA if you need one.
You get a written report: every finding rated by severity, explained in plain English, with a recommended fix and a prioritized action plan.
If you’d like, I harden the code: closing security holes, adding tests, and refactoring the riskiest parts. Or hand the report to any developer you choose.
What the audit covers
Secrets in code, authentication and authorization, injection risks, exposed endpoints, and vulnerable dependencies.
Bugs, edge cases, error handling, and data integrity: the things that work in a demo and break with real data.
What exists, what’s missing, and which tests matter most, so you can change code without fear.
Structure, duplication, dead code, and readability. Could another developer take this over?
Pinned versions, environment configuration, reproducible setup, and hosting.
Inefficient queries, runaway API usage, and scaling problems that could surprise you on your next bill.
What a report looks like
Illustrative examples, not from a client project.
Critical
Your OpenAI key is in settings.py. Anyone who ever sees the repo, including a future contractor or a leaked backup, can run up charges on your account.
Fix: rotate the key today, load it from an environment variable, and add a secret scanner so it can’t happen again.
High
The /invoices/<id> endpoint checks that someone is logged in, but not that the invoice is theirs. Changing the number in the URL shows another customer’s data.
Fix: look up invoices only within the current user’s account, and add a test that tries to read someone else’s.
Medium
When the model returns malformed JSON, the code retries with no limit. One bad response could make thousands of paid API calls overnight.
Fix: cap retries, add a timeout, and set a spending limit with your provider.
Pricing
Every engagement starts with a free intro call. You’ll get a fixed quote before any work begins.
From $4,500
Fixed quote after your intro call
A thorough review of all six areas, with a written report: severity ratings, plain-English explanations, recommended fixes, and a prioritized action plan.
From $9,500
For investors and acquirers
The same review, written for someone deciding whether to invest in or acquire a product. Adds an executive risk summary, a rough estimate of the effort to fix or rebuild, a dependency-license check, and whether a new team could take it over.
Typically $8,000–$25,000
Fixed-price quote from your audit’s action plan
I fix what the audit found: patching security holes, adding tests, refactoring the riskiest parts, cleaning up dependencies, and documenting what changed and why. Follow-up work: $350/hour.
Add-on to an audit
2-hour recorded Zoom session with your team; add-on to an audit. I walk you and your team through your own code, the findings, and the fixes, so you actually understand what you own.
50% of your audit fee credited toward Hardening booked within 30 days.
No judgment. The report is yours to keep. Use it with me, with another developer, or on your own.
Who you’ll work with
I’m Reuven Lerner. I’ve been a Python trainer, consultant, and author since 1995, and teaching people to understand code has been my career. That’s what separates this from a generic dev shop: you’ll come away knowing what you own.
I use Claude Code as a core part of my workflow. It makes me faster and more thorough. But every finding is reviewed, judged, and explained by me. You’re paying for experience, not an automated scan.
Is this a fit?
Python projects of all kinds: web apps (Flask, Django, FastAPI), data analysis and machine learning (Pandas, Polars, Jupyter, scikit-learn), scripts and automation, and AI/LLM-powered apps. If you need a Python code audit, you’re in the right place.
Unix shell scripts, Ruby on Rails applications, and PostgreSQL database apps.
Software written in C, C++, Java, or C#, and mobile apps.
Book a free 20–30 minute intro call. Tell me about your project and what worries you, and I’ll tell you honestly whether an audit makes sense.