24 points before agent-written code goes live.

No key, token or password is in the repository or its history.

The .env (or other secrets file) is in .gitignore and the web server never serves it.

No secret is in front-end code or a browser-visible variable.

The app's keys are its own, limited to what it needs, and you know how to rotate them.

Every page and API route that shows or changes private data checks, on the server, who is asking.

Admin, debug and setup pages are not reachable from the internet without a login.

Passwords are stored only as hashes made by the framework's password function.

Login and other forms that can be abused have rate limits.

Every database query uses parameter binding or the ORM; no SQL is built from user input.

Templates escape what they print; no raw user input goes into HTML.

File uploads (if any) are checked for type and size and stored outside the web root.

There is a backup of the data, and a restore has been tried.

Every package the agent added exists on the official registry and is the one you meant.

The lock file is committed.

The package audit command has been run, with no high-severity findings left.

Nothing is installed from an unknown URL, fork or pasted script without review.

Debug mode and detailed error output are off in production.

The site is HTTPS-only and sends basic security headers.

Error pages show a plain message, not stack traces or server paths.

Failures (bad logins, errors) are logged, and logs hold no passwords or tokens.

The code is in version control and you can get back to the last working version.

A person has read the diff before it ships.

Tests, or a written smoke check, cover the main path, and they pass.

The agent cannot reach production credentials or deploy without you.