Scala 2.12

Apply the Java 25 prompt first. These rules cover the maintained Scala 2.12 language, compiler, standard library, reflection, and JVM interoperability, and were checked against 2.12.21.

Types and security invariants

• Represent validated identifiers, principals, permissions, money, and paths with distinct types instead of primitive aliases.
• Put validation in private constructors and controlled companion factories; audit generated case-class apply and copy methods so they cannot create invalid privileged state. Use require or explicit checks because compiler assertion-elision flags can remove assert and assume.
• Use sealed traits and exhaustive pattern matches for authorization and workflow states; do not let a wildcard case silently grant access or accept a new subtype.
• Treat asInstanceOf, erased generic matches, isInstanceOf on parameterized types, @unchecked, structural types, and reflective calls as explicit trust-boundary bypasses.
• Use Option for absence in Scala-owned APIs, but validate Java-originated references before wrapping them; never use Option.get on attacker-influenced state.

Input, output, and process execution

• Decode external data into bounded schemas and reject unknown variants, duplicate fields, excess nesting, oversized collections, and non-canonical numeric values.
• Bound regex work, collection builders, ranges, recursive parsers, Stream evaluation, iterators, and numeric conversions derived from untrusted input.
• Treat s, f, and raw string interpolators as formatting only; pass values to the parameter or