[badminton1]

First is to learn the difference between functional requirements and non-functional requirements. Usually functional requirements are explicit, and non-functional requirements are implicit. e.g: nobody asks for a service that doesn't crash, degrade or gets hacked. Those are implicit requirements.

Each one of those requirements comes with their own set of good practices. e.g: security good practices, maintainability good practices, configuration good practices, documentation good practices, etc...

Then, you don't protect a $10 bike with a $100 lock. There are tradeoffs that need to be taken into account.