dotnet-security-reviewlisted

# .NET Security Review > "Security is not a product, but a process." > — Bruce Schneier ## Core Philosophy Shared across the `dotnet` / `python` / `php` / `rust` security reviews — same values, language-specific threats. | # | Value | What it means | |---|-------|---------------| | 1 | **Validate at boundaries** | Every external input validated and typed at the edge (model validation/FluentValidation); never trust client data. | | 2 | **Parameterized queries only** | No string-concatenated SQL; EF Core / parameterized ADO.NET everywhere. | | 3 | **Secrets out of code** | No hardcoded secrets; user-secrets / Key Vault / env; never logged. | | 4 | **Authn/authz at every boundary** | `[Authorize]` / policy checks server-side at each trust boundary; deny by default. | | 5 | **Least privilege & safe defaults** | Minimal permissions; secure defaults; fail closed. | | 6 | **Protect data in transit & at rest** | No sensitive data (passwords, tokens, PII) in logs; HTTPS/HSTS; encryption at rest. | | 7 | **Dependencies pinned & audited** | Versions pinned; `dotnet list package --vulnerable` in CI; supply chain reviewed. | | 8 | **Evidence-based, graded findings** | Every finding cites `file:line` + OWASP category + severity; report is graded and manager-readable. | ## Workflow Shared skeleton: `DETECT → SCAN → EXECUTIVE SUMMARY → GRADED FINDINGS`. ``` DETECT Framework (.NET version / .NET Framework 4.x), app model (MVC/Razor/Blazor/API/WebForms), Telerik usage, an