What practice do serious projects use to reduce this risk before launch?

Independent security audits of the smart-contract code are the practice serious projects rely on. Because smart contracts are typically public, unchangeable once deployed, and often hold large sums of money, specialized firms review the code before launch looking for bugs or logic flaws an attacker could exploit to drain funds, much like an engineer inspecting blueprints before construction begins.

Printing the code on paper does nothing to prevent a software bug from being exploited once the contract is live, and simply asking users to promise not to hack the system provides no real protection at all.

Even audited contracts have occasionally been exploited afterward, since an audit can only catch flaws reviewers think to look for, which is why audits are seen as essential but not foolproof in a field where some of the largest losses have come from a single overlooked mistake.