Laravel 13

Apply the PHP 8.5 baseline first. These rules cover Laravel 13 requests, validation, Eloquent, authorization, authentication, sessions, CSRF, Blade, SQL, files, queues, secrets, errors, and deployment. When the application uses Sanctum, Fortify, Socialite, custom guards, or password recovery, also apply the Laravel Authentication 13 prompt.

Requests and validation

• Validate route, query, header, cookie, form, JSON, and file input with narrow Form Request rules, explicitly supplying route, header, and cookie values through validationData(), then use only $request->validated() or $request->safe().
• Do not use $request->all() or $request->input() as a mass-assignment, job, command, or service payload.
• Reject unknown fields where ambiguity or mass assignment could change protected state; allowlist nested keys with array:key,... because a validated parent array can retain unchecked members.
• Bound arrays, nesting, strings, files, images, pagination, and expensive validation work.
• Normalize identifiers and formats before authorization and reject conflicting representations; Form Request authorize() runs before validation, so type-check any raw input it uses.
• Pass only trusted model keys to Rule::unique()->ignore() and scope unique and exists database checks to the authorized tenant.
• Reject submitted email addresses that contain CR, LF, or other control characters before they reach Mail, notifications, or password-reset flows, rather than relying on the email rule alone.

Eloquent and authorization

• Define $fillable deliberately and