01 · blast radius When it breaks, who notices?
Only me Me and a few colleagues My customers My customers’ customers, or the public
02 · data What is the most sensitive thing it will store?
Nothing, or public data Names and email addresses Financial or payment data Health data, or credentials and secrets
03 · exposure Where does it run?
On my machine, no network Internal network or behind a VPN Public internet, with a login I did not write Public internet, with a login I wrote myself
04 · regulation Does anyone official have rules about this?
No General privacy law applies (GDPR, CCPA) Payments, or sending bulk email Health, finance, or a licensed profession
05 · reversibility If it does the wrong thing, can you undo it?
Yes — delete the repo and move on Mostly, from a backup I have tested Partly, and it would be painful No — it sends, deletes, pays or publishes
06 · maintenance How long does this need to keep working?
Once. It is disposable A few months A year or two Indefinitely — other people are depending on it