Never hardcode API keys or secrets in source code

Use route groups to organize app sections

Architecture

Colocate page files with their route segment

Architecture

Use (select auth.uid()) instead of auth.uid() in policies

Performance

Use kebab-case for file and directory names

Quality