How do you test a web app before calling it production ready?

For those shipping web apps to clients or pushing to production, I am curious about your process.

Before you call something production ready, how do you validate security beyond basic scans?

In many projects I have reviewed, small issues pass unnoticed:

• An endpoint returns more data than expected
• Role checks are inconsistent across routes
• APIs expose internal assumptions
• Sessions can be reused in unintended flows

Individually these look minor.
Together they can create a path to real access or data exposure.

Static scans often flag isolated findings, but they do not show how weaknesses connect.

So I am interested in your approach.

Do you rely on:
• Automated scanners?
• Manual review?
• Threat modeling?
• External pentests?
• Nothing formal?

What does your “ready for production” security checklist look like?