A quote that comes back within a day should be treated as a bad sign. Any serious team responds with clarifying questions before any number: about integrations. A provider that commits to a figure without asking anything is simply working from a template, and the gap will be corrected later — on your budget.
Look out for any distance between the team in the pitch and the developers actually assigned. Request the names and CVs of the actual team in the agreement, with a clause about substitutions. A vendor that only offers roles and nearshore outsourcing never names individuals is keeping the option to staff you with whoever is free.
Ask for access to the repository from day one. A partner that hands over code only at milestones is inviting you to take delivery on faith. Daily commits reveal who is really on the project far better than a slide deck. The same applies to the CI pipeline: if it does not exist, assurances about quality remain just talk.
Ambiguous wording in the contract around IP is not an oversight. The agreement should state in plain terms that all outputs produced under it belong to your company as they are paid for. Look too at the governing law and how payments are structured: laravel vs next js heavy prepayment with no milestone tied to it eliminates any leverage you would otherwise keep.
Last, look at the working rhythm. Ask what overlap there will be with your timezone, who is expected to answer questions and within what time. Some genuine overlap is usually enough; no overlap converts each small question into a day of delay. Sloppy written English in the early emails does not improve once the work starts.