I built a Python preprocessing tool and a reviewer called it "low-trust" — here's what they got right