• Authentication flows that fail silently or throw 401s under real sessions
• Payment/webhook integrations (Stripe, broker APIs) with invalid signatures or missed events
• Race conditions and duplicate submissions under concurrent load
• Retry loops, memory leaks, and crashes that only show up after deployment
• Full production readiness review: what's solid, what's fragile, what needs to change before you scale