At Xave Finance, when we create a new contract we first deploy it on public and/or private testnets for integration and unit testing. Once we have internally ensured that everything is working as expected, we then deploy to a preproduction mainnet instance. Once any new feature has made it to our production mainnet instance, we then;
conduct bug bounties to attempt to drain the contract
Security Audits by a third party (before production deployment);
Complete correction of all issues found during the Audit period before deployment to live production dapp.