Keep secrets out of the repo, use environment variables, go through MRs for all changes, get at least one review before merging, write clean commit messages, avoid slow queries and N+1s, keep Docker images lean