CodeReviewPro Send me your code

Guide · Prices and scope

What a code review costs, and what that money buys

Code review is sold in at least three different shapes, and they are not the same product: a scan that matches patterns, a reading where someone works through your routes and your money path, and a repair where someone fixes what the first two found. Most confusion about price comes from comparing one shape against another. This page sets out what each one is, what I charge for it, and what changes the number.

Written by the reviewer at CodeReviewPro · prices for the Quick check and Deep check

01 / Three products, one name

A scan, a reading, and a repair

A scan

Tools that match patterns: a known-vulnerable dependency, a key-shaped string in the source, a query built by joining strings. Scans are cheap to run and they are worth running; every review I do starts with them. What they cannot do is tell you whether the finding matters here, in this app, on this route, for this customer. A scan reports a shape, not a consequence, and it stays silent about the mistakes that are only wrong in context.

A reading

Someone follows the code the way a stranger would: which route can be called by whom, where the price comes from, what happens if the charge succeeds and the write after it fails, what a second account is able to see. This is where the expensive mistakes live, and it is measured in hours of attention rather than in tool cost. It is the part of a review that has to be done on your code specifically.

A repair

Fixing what was found, by someone who did not write it. Priced per hour, because the size of the fix is not known until the finding is: changing a permission check is minutes, restructuring a payment flow is a day. Any honest, hour-based work gets estimated before it starts.

So when two offers differ by a factor of ten, the useful question is not which is cheaper, but which of the three shapes you are buying, and how much of your code the price actually covers.

02 / My prices

Fixed price, published in advance

I work solo, so the number is not a sales estimate: it is the price, decided by the size of the code and not by how bad the findings turn out to be.

Quick check — $299, or $149 for the first two clients

Up to 2,500 lines, report within 48 hours. A full read of the routes, the permission rules and the money path, with plain-English findings: what is wrong, the file and line, why it matters, how urgent it is, and roughly what the fix costs. The founding-client price of $149 applies to the first two clients who order.

Deep check — $799

Up to 15,000 lines, report within 5 business days. The same review, applied to a codebase where the surface is bigger: more routes, more integrations, more of the money path, and a closer look at failure handling and deployment settings.

Repairs — $120 per hour, only if you ask

After the report, and only on findings you want fixed. I estimate the hours before starting, you approve them first, and the work stays inside the findings you approved. Fixing things yourself from the report is a perfectly good outcome.

Free sample — up to 3 findings

Send a link, a zip or the files that matter and you get up to three findings for free, if I identify them, with file, line and evidence. No payment and no obligation, and the findings are yours to keep whatever you decide after that.

All prices are in USD. Payment only after we have agreed on the scope. No subscription, no retainer, no automatic charges. Please do not send passwords, live keys or customer data.

03 / What moves the number

Four things that decide the price

  1. 01

    How much code there is

    Lines of code are a rough measure, but they are the honest one for a fixed price: more files means more routes to follow and more places a check can be missing. That is also why the two packages are defined by size rather than by how alarming the result turns out to be.

  2. 02

    How much of it is the money path

    A project that charges cards, keeps a ledger or honours credits takes longer than a project of the same size that does none of that, because every step around charging has to be read twice: first for what it does, then for what it does when it fails halfway.

  3. 03

    How well it can be set up

    A repository that installs and runs with clear setup notes is faster to review than a zip of loose files with a database I cannot see the structure of. Not being able to run the code is not a blocker, but it does mean some findings stay as questions instead of answers.

  4. 04

    Your deadline

    48 hours for a Quick check and 5 business days for a Deep check are the normal windows. If you need something faster than that, say so up front: sometimes it fits, and if it does not, you will hear that before you pay anything.

04 / The cheap way in

Find out for nothing first

Nobody should have to buy an audit to learn whether they need one. The free first look exists for exactly that: send your code and you get up to three findings, with the file, the line and the evidence, before any money changes hands. If those findings are the ones you were worried about, you know what a full review is worth to you. If nothing serious turns up, you have your answer and you owe nothing.

The two things worth knowing before you send anything: read-only access is enough, and I do not need your production database, live keys or customer data — please do not send them. And if you would rather do the review yourself, the eight-check guide and the vibe-coded app checklist are on this site for free, with the same checks I work through.

05 / Straight answers

The awkward questions

Why a fixed price instead of an hourly rate?

Because an hourly review rewards the reviewer for finding more to say. A fixed price makes the incentive simple: read the code, report what is there, keep it short. If the code is clean, the report says so and the price is the same — that is not a loss for either of us, it is the answer you paid for.

Why is the first price lower?

The $149 Quick check is for the first two clients. A new practice has no track record to show, so the first clients get a lower price in exchange for honest feedback about how the process went, which the clients after them benefit from.

Do I pay if you find nothing serious?

The free sample costs nothing in every outcome: if three findings are not there to be found, you get that answer instead. For a Quick check or Deep check, you pay the agreed price for the review itself: what you buy is the attention and the report, and a short report is a real result.

Is a code review the same as a penetration test?

No, and it is worth being clear about it. A penetration test attacks a running system from the outside and tries to break in. A code review reads the source and the configuration and says what the code allows. The overlap is real, but I do not sell penetration tests, and if that is what you need I will tell you so rather than take the work.

Can I order repairs without a review?

Not from me. Repairs are priced from findings: without a review there is no agreed list of what to fix and no estimate to approve. If you already have findings from someone else, send them along with the code and I will tell you whether they fit the same way.

06 / Next step

Send your code, get a first look free

Send a repository, a zip or the files that matter, and you get the first findings for free: up to three, if I identify them, with file, line and evidence. If nothing serious turns up, you get that answer instead. A full review is a fixed price: Quick check $299 or Deep check $799, with repairs after the report at $120 per hour if you want them done. The first two clients pay $149 instead of $299.

free first look · up to 3 findings · no subscription, no retainer

Send me your code Read the sample report

Email works too: . Please do not send passwords, live keys or customer data.