“It’s just a few lines of code” is already a red flag