Technologies with a clear place in the wider system.

By reducing what is unknown before quoting, rather than padding a number to cover it. Requirements that are genuinely settled can be estimated with reasonable confidence. Requirements that are not — an unfamiliar integration, an undefined process, an unproven assumption about users — get a paid discovery step that produces a defensible scope. A fixed price quoted against uncertainty does not survive contact with the real system; it either gets renegotiated, which damages trust, or gets delivered thin, which damages the product. The honest sequence is to make the uncertain parts certain first, then price the rest.

Nothing, because it was never held anywhere you do not control. Repository, environments, database, domain and third-party service accounts should be in your organisation's name from the first day, not transferred at the end. Source code is delivered with schema and migration history, deployment steps, environment documentation and known limitations. The practical test of a handover is whether a different developer could take over from what you were given, without needing to ask us anything — and that is worth confirming during the project rather than at the point you need it.

It varies with what the system does, but a common planning figure is fifteen to twenty-five percent of build cost annually — and budgeting nothing is how working software becomes unsupportable. That covers dependency and security updates, defect response, monitoring, backups with tested restores, and the small changes every system needs as the business changes around it. Software that sits untouched for a year usually needs significant remedial work before it can ship again, because dependencies move, platforms deprecate APIs and security disclosures accumulate. Continuous small maintenance is consistently cheaper than periodic catch-up.

Usually, and it starts with an audit rather than a quote. That means establishing what it runs on, whether the source is complete, whether it can be built and deployed from scratch, what the dependency and version state is, whether backups actually restore, and what is undocumented. The audit is chargeable work and produces a written risk picture. The complications that matter are undocumented modifications, dependencies that can no longer be installed, and environments nobody can reconstruct — each of those needs a decision before an ongoing arrangement means anything.

As a build requirement rather than a review at the end. Server-side authorisation on every request regardless of what the interface prevents, validated input at every boundary where untrusted data enters, parameterised queries, secrets in encrypted storage with a documented rotation procedure, and dependency scanning in the pipeline. Beyond the code: least-privilege access to environments, audit logging on consequential actions, and a tested restore path. The gaps that show up most often in real systems are not exotic — they are missing authorisation checks on endpoints nobody expected to be called directly, and credentials that were committed once and never rotated.

Not if the project is set up correctly, and you should treat that as a requirement rather than a courtesy. Standard technologies with a real hiring pool rather than an unusual stack only we understand. Documentation written for someone who was not in the conversations. Accounts and repositories in your name throughout. No proprietary framework you would have to keep paying for. The measure is simple: if you decided tomorrow to move to another developer, how long would it take them to become productive? If the answer is more than a couple of weeks, something was built wrong.

Weeks rather than months, if the project is sequenced properly. Building in vertical slices means each release completes one journey end to end — genuinely usable rather than a layer that does nothing on its own. That matters because it lets you correct direction while correction is still cheap, and because a working thing generates far better feedback than a specification does. Projects that reveal everything at the end are the ones that overrun, since every misunderstanding compounds silently until it is expensive to unpick.

They will, and that is normal rather than a failure of planning. What matters is that changes are decided rather than absorbed. Each one gets assessed for its effect on scope, timeline and cost, then explicitly accepted or deferred. Projects overrun not because requirements changed but because they changed invisibly — a small addition here, a reasonable extra there, none individually worth a conversation, collectively consuming the budget. Making the trade visible each time keeps both sides in control of it.