Have someone read the quote who is not selling to you

How effort is normally distributed

Across most small and medium projects, effort splits into roughly: architecture and setup around a sixth, feature work around half, testing and quality around a fifth, and deployment plus documentation the remainder.

These are not rules, but sharp deviation is worth a question. Testing at three percent means it is not really planned. Setup at forty percent usually means the supplier is building infrastructure they will reuse on other clients, at your expense.

Items that are suspiciously cheap

Underpricing is more dangerous than overpricing, because it is invisible until the project is half done and the supplier starts recovering the difference.

• Integration with an existing system, priced as if the API is documented and works.
• Data migration priced in hours rather than days, on data nobody has looked at.
• Authentication and permissions, when there is more than one type of user.
• Anything involving payments, refunds or invoicing.
• Browser and device support, if it is not mentioned at all.

What is usually missing entirely

The commonest gaps are not deceptions. They are things suppliers assume clients know are extra, and clients assume are included.

• A staging environment separate from production.
• Error monitoring, so failures are noticed before customers report them.
• Backups, and at least one verified restore.
• Handover documentation for whoever maintains it next.
• Support in the weeks immediately after launch, when problems actually surface.

Rates against total price

An hourly rate on its own says almost nothing. A higher rate that comes with fewer hours and fewer defects is routinely cheaper in total than a low rate applied to a padded estimate.

Compare the total for a defined outcome, not the rate. And if a supplier will not quote a total for a defined outcome, that reluctance is the finding.