The summary.
VERSIONED ASSET FILENAMES
Without them, browsers serve cached styles and a change appears not to take effect.
Build for production before deploying, and serve static assets through the web server, never through PHP.
EVERY FORM NEEDS THE REQUEST PROTECTION TOKEN
A rejected submission without it is the framework protecting you, not a fault.
REPOPULATE EVERY FIELD AFTER A VALIDATION FAILURE
Losing entered data is the most damaging thing a form can do.
Show errors beside each field, not as a flash message.
REDIRECT AFTER A SUBMISSION
It prevents resubmission on refresh, and flash data survives the redirect.
PAGINATE, AND PRESERVE FILTERS ACROSS PAGES
Otherwise moving to page two discards the filter.
Watch query count on list pages — relationship loading per row hides there.
FORMAT MONEY AND DATES IN ONE PLACE
Otherwise the same value appears differently on different pages, and numeric dates are ambiguous between regions.
STORE TIMES IN A CONSISTENT STANDARD AND CONVERT AT DISPLAY
Define which zone a report covers, and state it.
