Technology
Studio engineering standards: what we require in every review
The checklist every change passes before it reaches production.
Every change we ship passes the same review checklist, regardless of whether it is a client project or one of our own products.
Authorisation before logic
Every endpoint that touches a record is covered by a policy. Reviewers check authorisation before they read the business logic, because an elegant implementation of an unauthorised action is still a security bug.
Validation on the server
Client-side validation is a convenience for the user. Server-side validation is the actual rule. Reviewers check that every input has a server rule, including the ones the interface makes it hard to submit incorrectly.
Queries eager-loaded
We run with lazy loading disabled in development, so an unloaded relationship raises rather than quietly issuing another query. Reviewers check that list endpoints load what their views render.
Migrations reversible
Every migration has a working down method. We test rollbacks in staging rather than discovering during an incident that a migration is one-way.
Uploads constrained
File uploads are checked for MIME type, extension and size, and stored under generated names. Reviewers verify all three, because two out of three is a file upload vulnerability.
None of this is novel. Applying it consistently is the part that takes discipline.
