Check access at the data boundary
A hidden button is not an access policy. Review server-side authentication and the permissions on every route and data operation. Test with two different users and confirm that each can only access what they should.
Make failures visible
Connect application errors, critical background jobs, and important third-party events to monitoring. An alert needs an owner and enough context to investigate. Avoid recording secrets or unnecessary personal data in logs.
Know how to recover
A backup is useful when it can be restored. Document what is backed up, how often it happens, and how you would recover the system. Test the procedure in an isolated environment before relying on it.
Document the release
Write down the deployment steps, environment variables, migration order, and rollback plan. Someone other than the original developer should be able to understand the process and find the right operational contacts.