In software engineering, we understand the concept of a code smell.
A single long method is not necessarily a disaster. An untested utility file is not ideal, but it will not crash the server. However, when you combine a long method, global state, and zero test coverage in a critical payment gateway, you have a ticking time bomb.
In security, this is called an exploit chain. One minor vulnerability is a bug; chained together, they become a catastrophic security breach.
I learned this the hard way when I started freelancing. Client communication has its own exploit chains.
A single red flag is often just a warning or a sign of an inexperienced client. But when specific red flags pair up, they form toxic combinations that almost always lead to unpaid invoices, infinite scope creep, or burnout.
