A quote that comes back within a day counts as a bad sign. Any serious team will come back with clarifying questions before any number: about users and volumes. A provider that commits to a figure before understanding the scope is probably working from a template, and that guess will be corrected later — on your budget.
Watch for a gap difference between php and python the team in the pitch and the developers actually assigned. Request specific people rather than roles in the statement of work, with a provision covering replacement. A team that will only describe roles and refuses to name people is preserving its own flexibility at your cost.
Ask for the source repository from day one. A team that shows code only at milestones is asking you to accept a black box. Daily commits tell you the actual pace far better than a weekly report. The same applies to the CI pipeline: if nothing runs automatically, promises about quality are just talk.
Ambiguous contract language around IP is never an accident. The document must state explicitly that the code, designs and documentation belong to your business as they are paid for. Also check the jurisdiction and node.js vs laravel the payment schedule: a large upfront payment with no deliverable attached eliminates the only leverage you have.
Lastly, examine how they communicate. Establish what overlap there will be with your timezone, which person is expected to answer questions and within what time. Some genuine overlap is normally sufficient; none at all stretches each small question into a twenty-four hour round trip. Unclear written communication in the proposal does not improve once the work starts.