Code review last week. A "fullstack" dev shows me his Laravel API. Clean on the surface — well-organized controllers, Eloquent migrations, Form Request validation. I ask him why he's using $request->all() instead of $request->validated() in his controller. Blank stare. He didn't know that all() returns everything in the payload, including...