CodeIgniter 4.7

Apply the PHP 8.5 baseline first. These rules cover CodeIgniter 4.7 on PHP 8.5; the framework requires PHP 8.2 or newer with intl and mbstring. CodeIgniter maintains only its latest release, so move to each new CodeIgniter 4 release, including a new minor, instead of staying on an older one. When maintaining or backporting framework code, keep the trusted-proxy check on forwarded HTTPS headers, deleteBatch() bind escaping, the extension checks in is_image and mime_in, and default upload-filename sanitizing.

Routes, filters, and authorization

• Keep Config\Routing::$autoRoute = false and define routes with explicit HTTP verbs and constrained placeholders. Avoid $routes->add() for mutations: it accepts unexpected verbs, while CSRF checks cover only POST, PUT, PATCH, and DELETE. Keep GET and HEAD free of state changes.
• Attach the application's authentication and authorization filters to every protected route or group. Deny access in before() by returning a response or throwing; returning false, merely constructing a redirect, or returning a redirect from initController() does not stop the controller. Perform record and tenant authorization before its side effects.
• When Shield authenticates an API, put its tokens, hmac, or jwt filter on every protected route group, issue access tokens with explicit scopes instead of the wildcard default, and check any further scopes with tokenCan(), or hmacTokenCan() for HMAC keys, because a route filter checks only the first one. Set $unusedTokenLifetime and per-token $expiresAt to your policy rather