I go through the code, lock down who can see what at the database, wire up payments, fix what breaks under real users, and put it on a proper deploy with tests. In the first few days you get a short written report of what I found, before I change anything.