# Spendio — Multi-user Security

Spendio uses `user_id` ownership for financial data.

## Rules
- Dashboard queries are scoped to `auth()->id()`.
- Transactions, accounts, categories, and budgets belong to a user.
- Creating a transaction assigns the authenticated user's `user_id` server-side.
- Related category/account records are resolved through the authenticated user.
- Do not trust `user_id` from browser forms or hidden fields.
- Any future show/edit/delete endpoint must resolve records through `where('user_id', auth()->id())` or an equivalent policy.

## Production checklist
- `APP_ENV=production`
- `APP_DEBUG=false`
- Use HTTPS
- Keep `.env` outside the public document root
- Run migrations with the production database
- Never expose database credentials in frontend code
- Add Laravel policies/form requests for every future resource mutation