As for security, as laurentl suggested the OWASP is a good starting point. From there look at all related security requirements of the country your project/prod

As for security, as laurentl suggested the OWASP is a good starting point. From there look at all related security requirements of the country your project/product will be subjected to. For scalability, pick a good database and get really familiar with the short comings of it (no design is 100% perfect). Also, check out the language/runtime for your project uses for scaling and what real world solutions others found effective (real-world is what counts on this one). For maintainability, look at the support pledge for each library, framework, middleware, etc. used in your product. Sticking with what is supported and what your clients can do is important. If a lib/framework/tool is going to be unsupported then that is going to cost you (either refactor a replacement or get ready for legacy). Maintenance is going to be an ongoing cost for any product and picking long term supported technology is key. I personally restarted my own project 3 times because of how fast support waned for the versions of technologies I was using. Another thing to consider is the future of your project. Every three to six months a genuine look at the product/project and the real world market needs.