- Use ActiveRecord scopes and query methods for database access — chain `.where`, `.includes`, `.joins` instead of raw SQL.
- Use Strong Parameters (`params.require(:model).permit(:field)`) in controllers — never pass unfiltered params to models.
- Use database migrations for all schema changes — run `rails db:migrate` and commit the `schema.rb` file.
- Use background jobs (Sidekiq, Solid Queue) for slow operations — mailers, API calls, and file processing should never block requests.
- Use Rails concerns and service objects to extract complex business logic from models and controllers.
- Use Active Record callbacks sparingly — prefer service objects for complex business logic.
- Use Strong Parameters for mass-assignment protection. Never skip parameter filtering.
- Use scopes on models for reusable query logic. Chain scopes for composable queries.
- Use concerns for shared behavior across models or controllers, but don't over-abstract.
- Use `rails credentials:edit` for secrets — never commit credentials to version control.