everything-claude-code/rules/csharp/security.md

paths

paths
**/*.cs **/*.csx **/*.csproj **/appsettings*.json

C# Security

This file extends common/security.md with C#-specific content.

Secret Management

• Never hardcode API keys, tokens, or connection strings in source code
• Use environment variables, user secrets for local development, and a secret manager in production
• Keep appsettings.*.json free of real credentials

// BAD
const string ApiKey = "sk-live-123";

// GOOD
var apiKey = builder.Configuration["OpenAI:ApiKey"]
    ?? throw new InvalidOperationException("OpenAI:ApiKey is not configured.");

SQL Injection Prevention

• Always use parameterized queries with ADO.NET, Dapper, or EF Core
• Never concatenate user input into SQL strings
• Validate sort fields and filter operators before using dynamic query composition

const string sql = "SELECT * FROM Orders WHERE CustomerId = @customerId";
await connection.QueryAsync<Order>(sql, new { customerId });

Input Validation

• Validate DTOs at the application boundary
• Use data annotations, FluentValidation, or explicit guard clauses
• Reject invalid model state before running business logic

Authentication and Authorization

• Prefer framework auth handlers instead of custom token parsing
• Enforce authorization policies at endpoint or handler boundaries
• Never log raw tokens, passwords, or PII

Error Handling

• Return safe client-facing messages
• Log detailed exceptions with structured context server-side
• Do not expose stack traces, SQL text, or filesystem paths in API responses

References

See skill: security-review for broader application security review checklists.