How to Vet a Contract Developer or Studio: 10 Questions Non-Technical Founders Must Ask

Hiring someone to build your software when you don't know how to code is terrifying.

You don't know if their quote of 16 weeks is standard or a gross overestimate. You don't know if their tech stack choice is modern or obsolete. And you certainly don't know if the code they write is clean and maintainable or a spaghetti disaster that will crash on launch day.

Most non-technical founders rely on "vibe checks": Does the developer sound friendly? Do they have a flashy portfolio? Did they smile on the Zoom call?

Unfortunately, charm doesn't prevent technical debt.

To protect your startup capital and ensure you actually receive production-grade software, you need technical vetting questions that separate real senior engineers from junior freelancers reselling boilerplate templates.

Here are the 10 essential vetting questions every non-technical founder should ask before signing a contract.

---

1. "Who owns the GitHub repository and deployment credentials on Day 1?"

• The Good Answer: "You create the GitHub organization and Vercel/Supabase accounts. You invite us as contributors. Every commit goes straight to your repository from Day 1."
• The Red Flag: "We build it on our internal private servers and hand over a .zip file when final payment is cleared."

Why it matters: If an agency hosts your code on their private accounts, they hold your entire business hostage. If a dispute arises over scope or billing, you lose your code. Always own your repository and infrastructure accounts from the first line of code.

---

2. "How do you handle database migrations and schema changes?"

• The Good Answer: "We use version-controlled SQL migration scripts (or Prisma/Drizzle migrations) checked directly into Git. Any schema changes are reviewed, tracked, and automatically applied across staging and production environments."
• The Red Flag: "We just edit the database tables directly in the dashboard when we need to add fields."

Why it matters: Direct dashboard editing is how production databases get corrupted. If a developer doesn't use formal migration scripts, subsequent developers will have no record of how your database was structured.

---

3. "What authentication and billing infrastructure will you install?"

• The Good Answer: "We integrate managed auth via Supabase Auth or Clerk, and billing via Stripe Checkout with webhooks. We never write custom password hashing or custom credit card forms."
• The Red Flag: "We'll build a custom login system from scratch with JWT tokens and custom payment forms to save you third-party fees."

Why it matters: Building custom auth and payments wastes 3–4 weeks of your budget and exposes you to severe security vulnerabilities. Any experienced developer uses established, SOC2-compliant managed providers.

---

4. "How do you structure environment variables and secrets?"

• The Good Answer: "We use .env.local for local development, which is strictly added to .gitignore. Production secrets are managed directly in the Vercel or hosting provider dashboard. We provide a sanitized .env.example file in the repo."
• The Red Flag: "We hardcode the API keys in the backend files during testing to make things faster."

Why it matters: Hardcoding OpenAI or Stripe secret keys into code repositories is how startups get their API keys stolen and wake up to $20,000 unauthorized billing spikes.

---

5. "What is your automated testing and quality verification process?"

• The Good Answer: "We enforce strict TypeScript compile checks (tsc --noEmit), ESLint linting, and automated end-to-end smoke tests for the primary checkout and core user flows before deploying."
• The Red Flag: "We don't need automated tests for an MVP. We just click around manually before we send you the link."

Why it matters: While you don't need 100% unit test coverage for an early MVP, you do need strict TypeScript typing and compile checks. Without them, a simple typo in a database column will break your app silently.

---

6. "Do you use AI coding agents, and how do you review the code?"

• The Good Answer: "Yes, we use AI coding agents (like Claude Code, Cursor, or Copilot) to accelerate boilerplate development by 2x–3x. However, every line of AI-generated code is reviewed line-by-line for security, edge cases, and architectural fit before merging."
• The Red Flag: "No, we never touch AI tools, everything is handwritten" OR "Yes, we just let the AI build the entire app without manual review."

Why it matters: Refusing to use AI tools means they are working at 2021 speeds and overcharging you for manual labor. Letting AI write code without senior architectural supervision means you are receiving hallucinated, buggy software. You want an engineer who leverages AI with disciplined oversight.

---

7. "Can you show me a production SaaS app you built and shipped in the last 6 months?"

• The Good Answer: The developer shares live URLs with real users, demonstrates responsive mobile behavior, and explains the trade-offs they made during the build.
• The Red Flag: Broken Figma prototypes, screenshot PDFs, or excuses like: "All our work is under strict NDA, so we can't show you anything live."

Why it matters: Anyone can design a pretty mock. Only real engineers know how to push code to production, configure custom DNS, resolve SSL certificate errors, and handle live webhooks. (For example, we point founders directly to our live products: saasdb.app, briefstock.ai, and feedalyze.net).

---

8. "What happens if a critical bug appears two weeks after delivery?"

• The Good Answer: "We include a 14–30 day warranty period where any bugs deviating from the agreed scope are fixed immediately at zero additional charge."
• The Red Flag: "Our hourly contract ends on delivery day. Any subsequent bug fixes require a new retainer or minimum hourly commitment."

Why it matters: If an engineer is confident in the quality of their software, they will stand behind their work with a post-launch warranty. If they demand an hourly fee to fix their own mistakes, run away.

---

9. "Is this a fixed-price scoped contract or an open hourly tab?"

• The Good Answer: "Fixed price. We define the exact feature scope in writing. If it takes us longer than expected, you don't pay a penny more."
• The Red Flag: "We work on Time & Materials at $85/hour. We estimate it will take around 8–12 weeks, but it depends on how things go."

Why it matters: Hourly billing creates perverse incentives. The slower the developer works, the more money they make. Fixed-price contracts align incentives: the developer is incentivized to work efficiently, and the founder has complete budget certainty.

---

10. "If I want to hand this codebase to another developer in six months, will they be able to run it in 15 minutes?"

• The Good Answer: "Yes. We include a comprehensive README.md with prerequisites, step-by-step local setup instructions, environment variable definitions, and architectural overview documents."
• The Red Flag: "The code is self-documenting. Any decent developer should be able to figure it out."

Why it matters: "Self-documenting code" is developer mythology. Without setup documentation and clear repository architecture, onboarding your next engineer will take two weeks of paid frustration.

---

Quick Developer Vetting Scorecard

Use this quick scorecard during your discovery calls:

| Evaluation Area | What You Want to Hear | Warning Sign | |---|---|---| | Code Ownership | Your GitHub organization from Day 1 | Hosted on agency private server | | Contract Model | Fixed price, fixed scope | Open-ended hourly billing | | Tech Stack | Next.js, Supabase, Tailwind, Stripe | Custom PHP, Angular, custom auth | | Code Review | Senior line-by-line review | Blind AI pasting or unvetted interns | | Warranty | 14–30 day bug-fix guarantee | "Pay hourly for bug fixes" |

---

The Araho Digital Standard

At Araho Digital, we don't hide behind hourly ambiguity or proprietary code repos. We operate on a fixed-price, 14-day turnaround model ($4,500). You own your GitHub repository from Day 1, receive full setup documentation, and get a 100% money-back guarantee if we don't deliver to the agreed scope.

Ready to scope your project with an engineering team that respects your timeline and budget?

Use our free MVP Scope & Cost Calculator or reach out to scope your project.