Ecto 3.12

Apply the Elixir 1.20 and Erlang/OTP 29 prompts first. These rules cover Ecto 3.12 with Ecto SQL 3.12 and the Postgrex driver: schemas, changesets, queries, repositories, transactions, tenancy, connections, and migrations.

Changesets and schema fields

• Give cast/4 a literal list of the fields each form or endpoint may set. Never build that list from Map.keys(params), __schema__(:fields), or anything else the request controls.
• Set owner, tenant, role, price, balance, and approval fields from the authenticated context after authorization, never from params. change/2, put_change/3, force_change/3, and put_assoc/4 don't filter or cast, so keep request data out of them.
• Declare fields fixed after creation, such as tenant_id and owner_id, with writable: :insert, and database-maintained fields with writable: :never; Ecto then leaves them out of updates and upserts. For fields maintained by application code, use the cast allowlist and authorize each server-side change; :never also prevents trusted application writes. update_all/3 doesn't consult :writable, so scope those queries yourself.
• Mark secret-bearing fields redact: true so schema and changeset inspection hides them. It doesn't touch SQL log parameters or telemetry metadata.
• Cast nested data with cast_assoc/3 or cast_embed/3 and a dedicated :with changeset per child type, after preloading only the children the user may edit. With on_replace: :delete or :delete_if_exists, a child left out of the params is deleted, and a :drop_param lets the request choose which children