𝗩𝗶𝗯𝗲 𝗰𝗼𝗱𝗲𝗿𝘀, if you’re building a fintech app, tell your AI this 𝗕𝗘𝗙𝗢𝗥𝗘 you even think about deployment: 𝗦𝗘𝗖𝗨𝗥𝗘 𝗧𝗛𝗘 𝗠𝗢𝗡𝗘𝗬 𝗙𝗟𝗢𝗪 • Never use floating-point numbers for money. Use integer minor units or a proper decimal type. • Use a proper ledger for every movement of money. Don’t make one mutable balance field your only source of truth. • Make every money-moving request 𝗶𝗱𝗲𝗺𝗽𝗼𝘁𝗲𝗻𝘁 so retries, double-clicks or network issues cannot create duplicate transactions. • Handle concurrency properly so two withdrawals hitting the same account at the same time cannot spend the same money twice. • Verify webhook signatures and safely handle duplicate, delayed, replayed and out-of-order webhooks. • Never trust the frontend to tell you a payment succeeded. Verify it server-side with the payment provider. • Enforce authorization server-side on every account, transaction and resource. • Keep API keys, database credentials and other secrets out of the frontend and your repo. • Add rate limits and sensible transaction limits to login, OTP, transfers, withdrawals and other sensitive operations. • Keep an audit trail of important financial actions without logging passwords, tokens or sensitive payment data. • Add reconciliation so your ledger can be compared against the payment provider or bank and discrepancies can be detected. • Design transactions so timeouts, crashes and failed dependencies cannot leave money in an unknown state. Then tell it: 𝘕𝘰𝘸 𝘸𝘳𝘪𝘵𝘦 𝘢𝘶𝘵𝘰𝘮𝘢𝘵𝘦𝘥 𝘵𝘦𝘴𝘵𝘴 𝘵𝘩𝘢𝘵 𝘢𝘤𝘵𝘪𝘷𝘦𝘭𝘺 𝘵𝘳𝘺 𝘵𝘰 𝘣𝘳𝘦𝘢𝘬 𝘦𝘷𝘦𝘳𝘺 𝘰𝘯𝘦 𝘰𝘧 𝘵𝘩𝘦𝘴𝘦 𝘢𝘴𝘴𝘶𝘮𝘱𝘵𝘪𝘰𝘯𝘴. 𝗡𝗢𝗪 𝗧𝗥𝗬 𝗧𝗢 𝗕𝗥𝗘𝗔𝗞 𝗜𝗧 → Send the same transfer 10 times. → Send 20 withdrawals against the same balance simultaneously. → Send the same webhook repeatedly. → Send a webhook with a fake signature. → Send webhooks out of order. → Kill a worker halfway through processing. → Simulate the payment provider timing out after taking the money. → Simulate the database failing halfway through a transaction. → Log in as User A and try accessing User B’s transactions. → Test ₦0, negative values, absurdly large values and malformed amounts. → Retry requests after timeouts. → Restart the application while a transaction is processing. Then reconcile your ledger against the provider and make sure 𝗲𝘃𝗲𝗿𝘆 ₦𝟭 is exactly where it should be. 𝗕𝗘𝗙𝗢𝗥𝗘 𝗥𝗘𝗔𝗟 𝗠𝗢𝗡𝗘𝗬 𝗧𝗢𝗨𝗖𝗛𝗘𝗦 𝗜𝗧 Run dependency, secret, static and API security scans. Test everything with your payment provider’s sandbox/staging environment. Set up monitoring and alerts for abnormal transactions. Get someone who actually understands security to review the critical flows. And if you’re handling card data or operating an actual financial product, understand the PCI and regulatory requirements that apply to what you’re building. 𝗟𝗔𝗦𝗧 𝗧𝗛𝗜𝗡𝗚: Don’t ask: 𝘊𝘭𝘢𝘶𝘥𝘦, 𝘪𝘴 𝘮𝘺 𝘢𝘱𝘱 𝘴𝘦𝘤𝘶𝘳𝘦? Ask it to prove specific properties, then try to break those properties yourself. If one duplicate request, race condition or failed dependency can make ₦1 𝗮𝗽𝗽𝗲𝗮𝗿, 𝗱𝗶𝘀𝗮𝗽𝗽𝗲𝗮𝗿 or 𝗺𝗼𝘃𝗲 𝘁𝘄𝗶𝗰𝗲, you’re not ready to deploy.