I give them everything then slowly pay for it (Say over 3 months); Yes, I know any competant programmer could remove these. But then again, if the programmer is competant, their is a good chance that they wont be looking for others to do their work in the first place, though there are still a handfull of reasons that this could potentially happen.

For number 3, I guess I stated it a little harsher then what I actually do. However in most cases, almost all problems should be taken care of during UAT. The user has agreed that what is delivered has met the requirements including any bugs that may have came up. However alot of times I will play this by feel.

For instance, if you have a registration script and the user decides that the username can consist of any characters, but then later comes back and describes a 'bug' in the registration process that allows special characters in the username, this will obviously be a cost fix. Should they have only wanted alphanumeric and maybe a few symbols, that should have been defined in the original requirements.