Vapor 4

Apply the Swift 6.3 baseline first. These rules cover Vapor 4 and its HTTP server, middleware, authentication, sessions, content, files, clients, and WebSockets, and were checked against 4.122.1. Fluent and Leaf rules apply only when those separate packages are installed.

Version and dependency boundaries

• Build with the Swift 6.3 toolchain on a supported operating system and verify the complete resolved dependency graph; Vapor's declared Swift 6.0 tools minimum does not establish the minimum of newer dependencies.
• Keep Vapor on the newest 4.x release: its security policy lists the 4.x line as supported, and fixes ship in new 4.x releases rather than backports to older ones.
• Check swift-nio, swift-nio-http2, and swift-nio-ssl separately from Vapor. Vapor's declared ranges admit releases that predate the HTTP parser, header validation, ByteBuffer, WebSocket, and certificate-name fixes, and vulnerability scanners miss some SwiftNIO advisories, so before each release compare the versions in Package.resolved with the fixed releases listed on each project's GitHub security advisory page and move to them with swift package update <name>.

Routes, middleware, and authorization

• Register authenticators before User.guardMiddleware() on protected route groups and use try req.auth.require(User.self) when retrieving required identity. Basic and bearer authenticators can continue without authenticating, and credentials authenticators swallow content-decoding failures; authentication middleware alone does not require login.
• Enforce resource, tenant,