Nothing reaches production unless I'm sure things are server side validated, or be accompanied by it. Authetication, rate limits... Nothing reaches prod if i don't review each line of code, structure, what happens when rate limits are hit in the last second before the window resets and requests from the same user, for example, arrive again in the first second after the reset. Buckets here have been useful.