Type checking (mypy with gradual strictness) - Security scanning (bandit) - Test coverage minimum (start at 60%)