# Python and Django code audit and security audit > A fixed-fee code audit and security audit for Django, FastAPI, and Flask apps. Python-specific checks, and a plan for what to fix first. - URL: https://velocitylabs.io/code-audit/python/ Python code audit # A code audit for Django, FastAPI, and Flask apps. Python apps get their own checklist, written for the problems Django, FastAPI, and Flask apps actually have. We review your code against it and tell you in plain English which findings matter and what to fix first. ## What a Python code audit checks Every Python audit covers the eight areas in every code audit, plus checks written for Django, FastAPI, and Flask. - ### Who can see whose data Lookups and Django REST Framework viewsets that aren’t scoped to the signed-in user, no default permission policy, FastAPI routes that skip the router’s auth, and tenant data that leaks between accounts. - ### Sign-in, sessions, and secrets Password, session, and token settings, throttling on login and password reset, a `SECRET_KEY` committed to the repo, and the Django admin open wider than your staff need. - ### Injection and unsafe input Raw SQL and f-string queries, `mark_safe` and `|safe` on user content, serializers and response models that expose or accept fields they shouldn’t, open redirects, and uploads. - ### Production settings `DEBUG` or the Werkzeug debugger reachable in production, browsable APIs and OpenAPI docs left public, CORS set for the wrong kind of auth, and proxy headers trusted blindly. - ### Data and speed under real traffic N+1 queries, missing indexes, emails and tasks fired before the transaction commits, blocking calls inside async routes, and connection pools that don’t fit your workers. - ### Version and upgrade path Whether your Python, Django, Flask, FastAPI, and Pydantic versions still get security fixes, and the deprecated APIs and abandoned packages that will block the next upgrade. ## More than a scanner report Every Python audit runs pip-audit, bandit, ruff, and Semgrep against your code, but scanners only find the patterns they know. The findings that hurt most in Python apps are usually ones a scanner can’t see: - A viewset that returns every customer’s invoices to any signed-in user - A sub-app mounted on FastAPI that never got the auth dependency - A PATCH endpoint that quietly resets the fields you didn’t send - A confirmation email sent before the order was saved Those come from reading the code, with a checklist written for Django, FastAPI, and Flask rather than a generic one. ## Python code audit pricing Three levels, each a fixed fee. Essentials covers the most important Python checks; Standard and Comprehensive cover all of them. [See everything every audit includes](https://velocitylabs.io/code-audit/). ### Essentials A fast health check **$1,000** fixed fee **Best for:** Answering "is this codebase OK?" before you buy, hire, or launch. - Review of your code, configuration, CI, and database schema - Automated scans for security issues, vulnerable and outdated dependencies, leaked secrets, and code quality - The essential checks for each technology in your stack - Critical and high findings written up in full ### Standard A thorough review **$1,500** fixed fee **Best for:** An inherited codebase, a pre-launch review, or before hiring a team. Everything in Essentials, plus: - Every check for each technology, not just the essentials - Your app and tests running in our isolated environment - How your team ships, when the code comes with its git history - Every finding written up in full ### Comprehensive Due diligence depth **$2,500** fixed fee **Best for:** Acquisitions and technical due diligence, compliance preparation, or after an incident. Everything in Standard, plus: - Line-by-line review of sign-in, payments, and data access - Steps to reproduce every finding - Your public website: accessibility, search visibility, and security headers - Domain and email setup: DNS, SPF, DKIM, and DMARC ## Is your Django version still supported? Django supports each feature release with security fixes for about sixteen months, and each LTS release for about three years. Python versions get security fixes for five years, and Python 3.10 reached end of life in October 2026. Every Python audit checks your Python and framework versions against the official support policies. If you’re behind, the report lays out the upgrade one step at a time, and Standard and Comprehensive also list the deprecated APIs and packages that stand in the way. When you’re ready, we can do the [upgrade](https://velocitylabs.io/maintenance/) too. _Django support today Latest: 6.1.3_ - Django 6.1Supported Bug fixesUntil Apr 2027 Security fixesUntil Dec 2027 - Django 6.0Security only Bug fixesEnded Aug 4, 2026 Security fixesUntil Apr 2027 - Django 5.2 LTSSecurity only Bug fixesEnded Dec 3, 2025 Security fixesUntil Apr 2028 - Django 5.1 and olderUnsupported Bug fixesEnded by Apr 2025 Security fixesEnded by Apr 7, 2026 Checked November 13, 2026 against the [Django release roadmap](https://www.djangoproject.com/download/). ## Python work we've built ![rentcheck results for a 2-bedroom home in 85013: a Fair Market Rent of $1,800 a month and HUD's income limits](https://velocitylabs.io/images/work/rentcheck.webp) ### rentcheck Enter a ZIP code and see HUD's Fair Market Rent and income limits for the area, whether your rent is above it, and whether you may qualify for housing help. - [Python](https://velocitylabs.io/portfolio/?tech=python) - [API Integration](https://velocitylabs.io/portfolio/?tech=api-integration) - [Docker](https://velocitylabs.io/portfolio/?tech=docker) [See more of our work](https://velocitylabs.io/portfolio/) ## Questions about Python code audits #How much does a Python code audit cost? The same fixed fees as every audit: $1,000 for Essentials, $1,500 for Standard, and $2,500 for Comprehensive. [Compare the levels](https://velocitylabs.io/code-audit/python/#pricing). Hire us for hourly development within 30 days of your report and up to $1,000 of the fee comes off your first invoice. #Is a Django security audit included? Yes. Every Python code audit includes a security audit: data access, the admin, sign-in, sessions, secrets, injection, and production settings, checked against the known weaknesses of your framework, plus pip-audit, bandit, and Semgrep scans. #Do you audit FastAPI and Flask apps too? Yes. FastAPI and Flask apps get their own checks: router and blueprint auth, response models that leak fields, sessions, the debugger, async routes that block, and Pydantic and SQLAlchemy versions. #Which versions of Django do you audit? Any of them, from apps on a long-unsupported release to apps on the latest one. If you’re behind, the report says how far and lays out the upgrade one step at a time; Standard and Comprehensive also list the packages that stand in the way. #Do you need to run our app? Essentials reviews the code without running it. Standard and Comprehensive boot your app and run your tests in an isolated, disposable environment. Either way, we never connect to your production servers, databases, or accounts. #Can you fix what the audit finds? Yes. We can work alongside your team or take it on ourselves, and the audit credit applies.