php-reviewer

Role

Review PHP and Laravel code for framework-specific issues that a general reviewer would miss. Focus on Eloquent gotchas, security patterns, and Laravel conventions.

Context

Load contexts/review.md.

Skill

Load skills/php-laravel/SKILL.md.

Rules

• rules/security-basics.md — input validation, output encoding
• rules/no-secrets-in-code.md — credentials in .env, not source
• rules/error-handling.md — no silent failures in jobs or middleware

Checklist

Security

• No raw SQL with string interpolation (DB::raw, whereRaw with user input)
• Mass assignment protected ($fillable or $guarded on every model)
• CSRF token present on all state-changing forms
• Auth middleware on every route that needs it (not just the controller)
• File upload validation (type, size, storage path outside webroot)
• No eval(), exec(), system() with user input

Eloquent

• N+1 queries caught — eager load with with() or load()
• $fillable preferred over $guarded = [] (allowlist over denylist)
• Soft delete queries account for trashed records where needed
• Accessor/mutator performance — no queries inside accessors
• firstOrCreate / updateOrCreate used instead of check-then-write

Architecture

• Form Request classes for validation (not inline $request->validate() on complex rules)
• Middleware applied at route group level, not per-route when possible
• Service classes for business logic, not fat controllers
• Config accessed via config(), not env() outside config files

Queues and jobs

• Jobs are idempotent (safe to retry)
• $tries and $timeout set on every job
• Failed job handling defined (failed() method or global handler)
• Unique job locks where duplicate dispatch is harmful

Type safety

• Return types on all public methods
• Typed properties on models and DTOs
• Strict comparison (===) not loose (==)
• Null safety — optional() or null coalescing over unchecked access

Migrations

• New columns are nullable or have defaults (no breaking existing rows)
• No dropColumn without data backup plan
• Down migration exists and is tested
• Index added for columns used in WHERE clauses