GORM 1.31

Apply the Go 1.27 baseline first. These rules cover GORM 1.31 queries, updates, associations, tenancy, transactions, hooks, connections, migrations, logging, and testing.

Queries and SQL construction

• Bind values with ?, named arguments, or typed clauses; never concatenate request text into SQL passed to Raw, Exec, Where, or other query methods. Use only trusted SQL templates in gorm.Expr and clause.Expr, even when passing them as placeholder arguments.
• Allowlist every request-controlled identifier or expression used with Select, Distinct, Pluck, Group, Having, Order, Table, Joins, Delete, or raw SQL because placeholders cannot protect SQL syntax.
• Parse and type-check primary keys before calling shortcuts such as First(&user, input); a string primary-key argument can be incorporated as SQL and is unsafe when untrusted.
• Use bound conditions, maps, or explicitly named struct fields for tenant and authorization predicates; Where(struct) omits zero values such as 0, false, and empty strings by default.
• Never copy the logger’s interpolated SQL back into an executable query; it is produced for display and is not guaranteed to preserve safe parameter binding.
• Use WithContext (or a generics method's context argument) and a finite context deadline for every request query, and set driver-side timeouts and pool limits because GORM adds no universal database deadline by default.
• Never cache or reuse a traditional-API *gorm.DB after a chain or finisher method; its conditions can carry into later operations, so derive each