I'm a freelancer in germany and I used to work for a small web-design studio. However they managed a not-so-small eCommerce site. I got the job through a friend in this typical "hey, we have a minor problem there, could you have a look"-manner. So I took a look and fixed the bug. They were satisfied with my quick work and soon other minor thinks came up. Then bigger ones and so on until I became a regular supporter to their team. Well support is the wrong word here, I was their only programmer (and also the only one who knew HTML and CSS, but that's probably not so important in that business). We always said we really should have a contract, but we never actually did set one up.
The last thing I did for them was a new newsletter system. The old one was just a php-script that had to run in an opened browser window. It processed a few addresses and then would reload the page to process the next few. This was ok in the beginning, but meanwhile they had more than 750,000 mails to deliver and so the browser page based version was to be replaced with a cron-job. The problem was: I didn't know how long the script would run. So it was executed every few minutes, checks if the script was still running by looking through a list of active processes (using
ps) and terminates if it found the script to be running. It worked on my machine. I insisted on testing this more thoroughly, but the management decided to put it on for production. Production in this case meant: the same server where the database and apache ran on.
So, there was a bug. The newly executed script would only find old instances if the pid of the running instance was smaller than the new ones. It was a stupid bug and it was my fault. The script went production on a Friday and I was only notified on Monday. Meanwhile our hoster took down the entire server as it behaved like an infected machine, sending dozends of the same mails to the same addresses. The shop was offline for a whole weekend. Other weekends brought in sales of about 100,000 €. I was a student.
If you are employed at a company in germany you cannot be hold liable for this kind of damage (maybe if your contract sais otherwise, but I would guess that this isn't even legally possible). However, being a freelancer is a whole other story. By default I was liable. Now I did not agree to run this in production and I also -- long ago -- informed them that running everything on one server, especially the mailing system was not the best idea. But I couldn't proof it. We didn't have a contract and of course we never documented those kind of things neither.
In the end I was very lucky and they didn't try to hold me liable. I still had a few sleepless days till their decision.
Have a contract, check liabilities. Also think about thinks like licensing. Are they allowed to use your work in every manner they want? Can they resell thinks? May they used it in other countries? In other contexts? Do they need your permission, do you want (and deserve of course) extra money for that?
You may find better sleep ;D