Find the holes in your build before your users do.

Your requirements live somewhere other than a chat thread — what it does, who it's for, what "done" means.

The business rules and the weird edge cases are written down, not just in your head.

You know your user types and what each one is allowed to do, on purpose.

You have a separate place to test — you're not building and testing on live data.

Your test data is fake, not real people's real information.

Testing on real people's real data is a red flag on its own.

You have a plan for going to production, including how existing or real data gets migrated or converted.

A user can only see and change their own data — and you've actually tried to read someone else's and got blocked.

If anyone can read another user's data, you're not ready no matter the score.

Your API keys and secrets live on the server, not shipped in the app or the browser.

Keys visible in the browser or app are a red flag on their own.

Anything that costs money or sends email has a rate limit or abuse control.

Sensitive calls (payments, email, AI, storage) go through your server, not straight from the front end.

Gated or paid files can't be grabbed just by guessing the URL.

You only store data you actually need — nothing kept "just in case."

You know exactly where personal data lives and who can reach it.

You know what you'd do, and what you'd have to tell people, if there was a breach.

You've tested with realistic numbers, not just you clicking around.

You have budget caps or billing alerts so you can't wake up to a surprise bill.

When something breaks or a third party goes down, it fails cleanly and doesn't dump errors to the user.

It's in version control and you can roll back a bad change.

You have at least some tests, or a written way you confirm nothing broke before you ship.

You have a rollback plan and a way to know (logs or monitoring) if something's wrong after launch.

You have backups — and you've actually restored one to check it works.

No backups, or a backup you've never restored, is a red flag on its own.