Anyway, while I'm sure you-are-not-a-lawyer, if you have any advice regarding what to put in a contract I'd be keen to hear it.
The bit I'm most concerned about is the fact that it's a pretty legacy codebase, and there are almost certainly vulnerabilities I'm not aware of. At the moment I have a loosely worded (and accepted) email where I basically say "you put everything into production once you've tested it, as it's a legacy system without decent test coverage". However, I'm paranoid I'll make a mistake / it'll get hacked and then I'll get sued. Admittedly I live in a different country from the client & I am doing things through an LLC so perhaps its safe enough.
Still, if you have any advice/pointers from the trenches, I'd be keen to hear it. I honestly don't care too much about loosing a months salary, so much as loosing the shirt off my back!
But I would never ever hire a contractor on such terms.
Never.
No company in their right mind would put their IP at risk due to some fuzzy contractual language - and it's always fuzzy, subject to interpretation.
The contract could conceivably be 'interpreted' as 'all the companies IP' and all it takes is an angry contractor who is pissed and thinks he can make zillions $ to make your life hell.
Personally - I've only had good experiences, but I take a different approach. I just withold milestone delivery until I get paid, until I sense the credibility of the institution.
There have been a few comments such as 'I will take down your site if you don't pay' etc. - this is a reflection of the power that the contractor has, and it implies something more than legal leverage, really.
Also - the moment I whiffed there was going to be a 'non payment scenario' - I'm out.
If you're getting paid often enough, at least your losses are limited.
But usually I send in an invoice as the first milestone is done (usually there is enough conversation/back-forth for them to know the milestone effectively done - or like a web-demo or something), and softly hint that I'll send in the deliverable (i.e. code and assets) when it's paid.
There's no way a company can take you to task for code what you have written, wherein you have not been paid. Even if they did - it would be a long, expensive process and would be a huge distraction from whatever it is they are trying to do. The pragmatic reality of 'you get the milestone for payment' trumps any kind of legal contextually - if they want to move forward they need to pay, it speaks right to the operational reality of their bottom line.
But lucky enough, I've never had a problem.
If a company is worried that the terms of an actual stated, signed contract are too fuzzy, they should be far more worried about not having one.
This obviously varies by jurisdiction, but if you're US based you can absolutely sign electronically (there's an entire Act that enables it). The easiest way is to use services like Echosign or Docusign which most people are pretty familiar with these days.
Or if you do work as a freelance contractor, you can pay a business lawyer 4 to 6 hours of their time to draft up a services agreement that you will use as a template for every client going forward.
Client doesn't pay me (after some nudges that they should)? Well according to the services agreement there was no IP transfer, because I wasn't paid. They continue to use the IP? Well the contract they signed says I can sue the hell out of them (and win) as recourse. Client wants something changed after delivery and payment? I'm not obligated to do squat, as the service agreement says that since they signed off on the delivery receipt, they supposedly were fine with it. The services agreement makes sure I get paid, the client doesn't try to put me over a barrel, and makes sure I'm making good by my client. That's what you have them.
Seriously. Always have a contract.