Why an unmaintained application becomes dangerous
A Laravel application rests on around thirty direct dependencies, themselves resting on several hundred. Every month, some publish security fixes. After a year without updates, an application typically accumulates several publicly documented vulnerabilities — and therefore easily exploitable ones.
The cost of catching up grows non-linearly. Moving from one major version to the next takes a few days; catching up on three major versions looks like a rewrite.
The quarterly review
This is the most useful part of the contract and the one most often missing elsewhere. Once a quarter we review three things: accumulated technical debt, how performance indicators have moved, and improvement opportunities visible in usage data.
The aim is to avoid the most common situation in our industry: an application that works, that nobody touches, and that turns out to be beyond saving the day a change becomes necessary.