Every Mesrai rule, in one place

Access tokens, HMAC salts, and KMS keys for PHI flows must come from a secret manager or encrypted credentials store; forbid committing secrets or .env files to the repo.

Every catch block must log or report the error at least once before handling or rethrowing.

For dynamic data use { cache: 'no-store' } or file-level dynamic = 'force-dynamic'. For ISR use { next: { revalidate: N, tags: [...] } }.

Prefer reversible change or explicit up/down to support rollbacks.

Ensure that variables that never change are marked as `const` to prevent accidental modification and enhance code clarity.

Before emitting logs, detect and redact PII and secret patterns (emails, tokens, keys). Replace values with consistent hashes or tokens; never log full credentials.

Never write raw personal data to logs. Apply irreversible masking/redaction (e.g., CPF → ..-; emails → f**@domain.com). Include the LGPD purpose in the log context and prefer structured logging.

Keep middleware fast and side-effect free (no DB writes). Narrow the matcher and skip static assets. Use Route Handlers for heavy logic.

Collect only strictly necessary fields for the declared purpose; mark optional PII as nullable and omit from payloads when empty. Fail requests that include undeclared extra PII keys.

Load and validate environment/config once during startup; inject settings into modules instead of re-reading env.

Configure Spring Boot to require client certificates for internal APIs (clientAuth=REQUIRE) and restrict CAs; log peer certificate subject in audit events.

Read secrets (process.env.*) only in Server Components, Route Handlers, or server actions. Client Components must use ONLY NEXT_PUBLIC_* variables.

Prefer JOINs/eager loading over per-row queries to avoid N+1 patterns.

Index columns used in JOIN/WHERE/ORDER BY; verify plans and avoid full scans for hot queries.

Ensure LINQ queries translate to SQL efficiently (avoid client evaluation, use projections, defer ToList until needed).

Replace per-row lookups with JOINs or bulk queries to fetch related data in fewer round-trips.

Use joins for filtering on associations and includes/preload for eager-loading to avoid N+1.

Validate inputs and preconditions up-front and return early before issuing any database queries.

Consent must be stored per user and per purpose with lawful_basis, version, granted_at, source, and optional revoked_at. Do not overwrite or store a single boolean flag. (GDPR Art. 7, purpose limitation)

If a PR adds new PII fields (e.g., email, phone, address, dob, national_id), include links to updated DPIA and RoPA, migration with retention, and masking rules. Add a checklist item confirming lawful_basis. (GDPR Art. 35, Art. 30)

Use immutable image digests (repo@sha256:...) instead of mutable tags for production workloads.

Base images must be pinned to an exact version and content digest (@sha256) to guarantee reproducible builds and supply-chain integrity.

Use version constraints for required_providers and modules, and include .terraform.lock.hcl in PRs that change dependencies.

Provide an authenticated endpoint that assembles a user's data into a structured JSON export and returns a short-lived signed URL (≤24h). Include integration tests in the PR. (GDPR Art. 20)