I got an offer of a "code review" like that once for an authentication system and never heard back; it was open source anyway so anybody could have downloaded it and found my rookie mistakes like

  signed_token = content + MD5(secret_key+content)

which doesn't stop anyone from appending to the content (might not have really been exploitable, but any honest review from somebody who knew more than me would have turned it up)