SOTA C# / .NET (2026)

Expert-level rules for producing and auditing production .NET. The runtime is memory-safe, so risk concentrates in injection, deserialization, async correctness, and dependency supply chain. Baseline: .NET 10 LTS (released Nov 2025, supported to Nov 2028) and C# 14 (records, nullable reference types, pattern matching, spans, extension members, the field keyword) — flag where a control needs a specific version. Every rule states the why; every rules file ends with an audit checklist of grep/analyzer patterns.

Purpose

Two consumers, one source of truth:

• BUILD mode — generating C#/.NET: follow the rules as defaults. Enable

nullable reference types and treat analyzer warnings as errors; prefer immutability and the async-all-the-way model. Deviate only with a comment.

• AUDIT mode — reviewing existing code: hunt violations with the audit

checklists, classify by severity, report in the finding format below. SQL string-building and legacy deserialization are presumed exploitable.

BUILD mode

1. Before writing, read the rules files relevant to the task (see index). A web

API touching untrusted input + a DB + async needs 02, 03, 04.

1. Apply the top-10 non-negotiables (below) unconditionally.
2. New projects: target the current LTS (net10.0), <Nullable>enable</Nullable>,

<TreatWarningsAsErrors>true</TreatWarningsAsErrors>, <AnalysisLevel>latest-Recommended</AnalysisLevel>, NuGet lockfile + RestoreLockedMode in CI, and dotnet format from day one (rules/06).

1. Async all the way down — never block on async (.Result/.Wait()/

GetAwaiter().GetResult()) (rules/03). Use CancellationToken end to end.

1. Prefer the BCL and well-known libraries; parameterize all data access; use

the framework's auth/Data Protection rather than rolling your own (rules/04).

1. When you take a sharp path (reflection, unsafe, DynamicMethod, suppressing

a nullable/analyzer warning), leave a // NOTE(sota): explaining why.

AUDIT mode

Work each relevant rules file's audit checklist against the target. Run the greps and the Roslyn analyzers (incl. the security CA rules); confirm hits manually. Check the dependency tree against known-CVE databases.

Severity conventions

Finding format

[SEVERITY] File.cs:LINE — short title
  Rule: rules/NN-name.md § section
  Evidence: the offending line(s), verbatim
  Impact: one sentence — what executes/leaks/deadlocks, under what input
  Fix: concrete replacement code or action
  Effort: trivial | small | medium | large

Group findings by severity, CRITICAL first. End with: counts per severity, the three highest-leverage fixes, and which checklists/analyzers were run.

Rules index

Top-10 non-negotiables

1. No string-built SQL. Parameterize: EF Core LINQ or parameters

(FromSql/interpolated FromSql, never FromSqlRaw/ExecuteSqlRaw with concatenation); Dapper with parameters. Interpolated/concatenated SQL is CRITICAL. (rules/04)

1. No unsafe deserialization. BinaryFormatter is removed in .NET 9+ (throws);

never reintroduce it or NetDataContractSerializer/LosFormatter/SoapFormatter, and never use Json.NET TypeNameHandling.Auto/All or JsonSerializer with an unrestricted type resolver on untrusted data. Use System.Text.Json with known types. (rules/04)

1. Async all the way; never block on async. No .Result, .Wait(),

.GetAwaiter().GetResult() on a hot/request path (deadlock + thread-pool starvation). async void only for event handlers. (rules/03)

1. Flow CancellationToken end to end through async APIs and honor it.

(rules/03)

1. ConfigureAwait(false) in library code (code with no sync context that

doesn't need to resume on the original context). (rules/03)

1. Nullable reference types enabled and honored. <Nullable>enable</Nullable>;

don't paper over warnings with the null-forgiving !. (rules/01, rules/02)

1. Deterministic disposal. Everything IDisposable/IAsyncDisposable is in a

using/await using or owned by a DI-managed lifetime — HttpClient via IHttpClientFactory, not new-per-call. (rules/02)

1. Crypto uses the right primitives. RandomNumberGenerator (never Random)

for tokens/keys/IVs; AES-GCM (not ECB); no MD5/SHA-1 for security; ASP.NET Core Data Protection for at-rest tokens; never disable TLS cert validation. (rules/04)

1. AuthN/AuthZ enforced server-side on every non-public endpoint

([Authorize]/policies/endpoint auth), antiforgery for cookie-auth POSTs, CORS locked to known origins. (rules/04)

1. Analyzers + nullable + lockfile gate CI. TreatWarningsAsErrors,

Roslyn analyzers (incl. security CA rules), dotnet format --verify-no-changes, NuGet locked-mode restore + CVE scan. (rules/06)