1. Policy Overview The purpose of this policy is to establish a strict baseline for code quality, maintainability, and security across all our Laravel applications. All web developers handling backend architecture must adhere to these guidelines before submitting code for review. Consistency in our codebase ensures that new joiners can easily understand the project and helps us prevent critical security vulnerabilities.
2. Coding Standards and Architecture We strictly follow the PSR-12 coding standard. To maintain architectural consistency, developers must observe the following rules:
3. Security and Data Protection Security is a primary concern for our software. Developers must actively prevent common vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF).
4. Database Management Direct modifications to the production or staging databases are strictly forbidden. All structural changes to the database, including creating tables, adding columns, or inserting default seed data, must be done through Laravel Migrations and Seeders. This ensures our database state is trackable via version control and can be easily replicated by new developers setting up their local environments.
5. Enforcement and Code Review This policy is enforced through our automated pipeline and peer review process. All Pull Requests must pass automated testing and receive at least one approval from a senior developer before being merged into the main branch. Any code failing to meet the security or standard requirements will be rejected.
- Protect models against mass-assignment vulnerabilities by strictly defining the fillable array on all Eloquent models. Never use the guarded property with an empty array.
- Ensure CSRF protection is enabled on all web forms interacting with our Laravel backends, unless the route is specifically designated as a stateless API endpoint.
- Never use raw SQL queries with unescaped user input. Always use Eloquent ORM or the Query Builder to ensure inputs are automatically sanitized.
- Hardcoding configuration values in the code is strictly prohibited; always use the environment variables and the config helper.
- Run Laravel Pint or PHP CodeSniffer locally before pushing any commits to the repository.
- Always use Laravel Form Request classes for validation instead of validating directly within the Controller.
- Controllers must remain thin. Business logic should be extracted into Service classes or Action classes.