What is the best way to test dapps?

I am planning to put part of my portfolio into gmx but wanted to test the app locally first.

My plan was to run the ethereum blockchain locally and then deploying the contract and just trying out stuff to see what is possible for the deployers/admins (can they freeze/steal my money and stuff like that).

I have never done anything like this before and was wondering where to start. Is it better to deploy the contract locally or should I use a test network? Like, what do the pros do when they test a dapp? I can't imagine they just read the code. In the end you still need an execution environment but I'm not sure how that environment is supposed to look like and wht