Standards applied across the stack, organised by where the work happens. These codify established practice — OWASP guidance, framework security documentation, well-understood patterns — rather than recounting specific engagements.
rules/laravel-application-rules.md
Laravel
Applies when — Day-to-day controllers, models, policies, requests
When a service class earns its existence and when it is a controller method with extra steps. Where logic actually belongs. Transaction boundaries that never wrap a third-party call. The authorization check everyone forgets.
Service layer
Policies
Mass assignment
PHPDoc shapes
Read this rule ↗
rules/rest-api-rules.md
REST APIs
Applies when — Designing or changing an API other people depend on
Response shape stability beats elegance. Object-level authorization — user A fetching user B by guessing an ID — is the most common serious API flaw. Idempotency, error envelopes, and pagination that survives concurrent writes.
Versioning
OWASP API #1
Idempotency
Cursor pagination
Read this rule ↗
rules/database-rules.md
MySQL & PostgreSQL
Applies when — Schema, indexes, and migrations on tables with real data
A constraint in the database beats a check in application code, because application checks race and constraints do not. Composite index column order. Which migrations lock a table offline, and how that differs sharply between engines.
Money is never a float
EXPLAIN
Expand/contract
Lock behaviour
Read this rule ↗
rules/react-rules.md
React & React Native
Applies when — Frontend state, security, and render cost
Conflating server state with client state causes most React bugs. Derived values that should never have been state. The useEffect-as-data-fetcher antipattern. Measuring re-renders with the Profiler instead of guessing at memo.
Server vs client state
XSS
Token storage
Profiler
Read this rule ↗
rules/python-rules.md
Python
Applies when — Services, data work, and anything that started as a script
Separating I/O from computation so logic is testable. Pickle deserialization is remote code execution. Type hints as executable documentation. Where Python is genuinely slow and where that is a myth.
Module boundaries
Unsafe deserialization
The GIL, accurately
Read this rule ↗
rules/ai-integration-rules.md
AI / LLM integration
Applies when — Shipping a feature that calls a model in production
A model call is an external write to a system you do not control. Prompt injection — especially indirect, via retrieved documents — is the central threat. Model output must never reach a privileged action unvalidated. "The system prompt says not to" is not a security control.
Prompt injection
Schema-constrained output
Cost ceilings
Eval sets
Read this rule ↗