Laravel 12

Apply the PHP 8.4 baseline first. These rules cover Laravel 12 requests, validation, Eloquent, authorization, authentication, sessions, CSRF, Blade, SQL, files, queues, secrets, errors, and deployment. When the application uses Sanctum, Fortify, custom guards, or password recovery, also apply the Laravel Authentication 12 prompt.

Requests and validation

• Validate query, form, JSON, and file input with narrow Form Request rules, then use only $request->validated() or $request->safe(); explicitly include route, header, and cookie values in validationData() or validate them separately.
• Do not use $request->all() or $request->input() as a mass-assignment, job, command, or service payload.
• Reject unknown fields where ambiguity or mass assignment could change protected state; constrain nested keys with array:allowed_key,... and validate each child value rather than accepting a bare array rule.
• Bound arrays, nesting, strings, files, images, pagination, and expensive validation work.
• Normalize identifiers and formats before authorization and reject conflicting representations; prepareForValidation() runs before authorize(), and authorize() receives input before the validation rules have passed.
• Pass only a server-selected model or its key to Rule::unique(...)->ignore(...); never use a request-supplied exclusion ID.

Eloquent and authorization

• Define $fillable deliberately and keep IDs, tenant, ownership, roles, status, price, and audit fields guarded; unguard(), unguarded(), forceFill(), direct attribute assignment, builder