Solana devs: 10 things to check before you ship to mainnet 1. Upgrade authority behind a multisig. Not 1 of m, not m of m. Add a timelock. 2. Every account validated: owner, discriminator, seeds, signer, writable. 3. Every CPI target pinned to a known program ID. 4. remaining_accounts parsed like hostile input: count, order, owner, duplicates. 5. No plain init on addresses others can create first (main offender: ATAs). 6. Accounts closed properly, so they can't be revived. 7. Checked math, rounding in the protocol's favor, no lossy casts. 8. Accounting that doesn't trust raw token balances. 9. Monitoring, a way to pause, and an incident plan with names and phone numbers. 10. A security.txt, so whoever finds your bug can actually reach you. Want a second pair of eyes before launch? dms are open.