If you have a program that absolutely must run as SUID, try to avoid equipping the program with a general-purpose programming interface. Resist the temptation to make something SUID to root if you can accomplish the same goals by making it SGID to a new group. Always use full path names for any argument, for both commands and files. Anything supplied by the user that is then passed on, written into a file, or used as a filename should be checked for shell meta characters. Examine your code and test it carefully for assumptions about the operating environments.
Many programs designed to be run as daemon or bin can cause security programs when run as root.
Make good use of available tools. If you are using C and have an ANSI compiler available, use it, and use prototypes for calls. If you don't have an ANSI C compiler, then be sure to use the lint program to check for common mistakes. Test your program a lot. Look into GCT, a test tool developed by Brian Marick at the University of Illinois.