SQLite Standards

Config in env vars, not code. Never commit .env. Commit .env.example. Never hardcode secrets.

Passwords: bcrypt. API keys: encrypt. PII: field-level encryption. Never log sensitive data.

Index: foreign keys, WHERE columns, ORDER BY columns, JOINs. Use EXPLAIN ANALYZE to verify.

Wrap multi-step DB operations in transactions. All-or-nothing, prevents partial updates.

Use latest stable versions. Fix breaking changes—don't avoid upgrades. Check official registries.

Async drivers: asyncpg (Postgres), SQLAlchemy 2.0 async. Match FastAPI's async nature.

Small, focused commits. Use: feat/fix/refactor/test/docs/chore. Each commit independently deployable.

No excuses: 'pre-existing', 'unrelated', 'tedious', 'for now'. Recognize and continue working.

You wrote every line. No 'pre-existing issues'—only issues you haven't fixed yet.

User and tests define done. Don't redefine scope or declare partial progress as complete.

Rails.application.credentials for secrets. `rails credentials:edit`. Environment-specific credentials. Never commit master.key.

Add NOT NULL, UNIQUE indexes, foreign keys, check constraints. Don't rely only on ActiveRecord validations.

Auth: bcrypt/argon2 for passwords, rate limiting, secure sessions/tokens. Authz: check permissions on every request, use policy objects or middleware.

Force SSL, redirect HTTP→HTTPS, secure cookies (Secure/HttpOnly/SameSite), HSTS headers.

Allowlists, not denylists. Validate type/length/format. Sanitize HTML. Parameterized queries only.

Test real instances. Mocking the class under test hides bugs.

Fix failures immediately. No skipping, no "pre-existing issues." Own the codebase state—a test suite with ignored tests can't be trusted.

1) Write failing test 2) Minimum code to pass 3) Refactor. Every line has a reason.

Test public interfaces, inputs/outputs. Tests must survive refactoring. Don't test private methods.

Mock only: external HTTP APIs, time, filesystem side effects, third-party services. Use real implementations for internal services, database, and business logic.

One logical concept per test. Multiple asserts OK if same concept. Clear test names describing behavior.

Use consistent test data setup: fixtures for stable reference data, factories for dynamic scenarios. Avoid inline object creation scattered throughout tests.

Verify changes locally: run app, run tests, check for errors. CI catches environment issues, not basic bugs.

Format → Lint → Test before every commit. Never rely on CI for basic checks.