Do not open public issues for security vulnerabilities.

If you discover a security vulnerability, please email security information privately to the project maintainers.

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if available)

We will acknowledge receipt within 48 hours and provide an update on the fix timeline.

• ✅ Input validation (FluentValidation)
• ✅ Exception handling (no sensitive data leakage)
• ✅ Soft delete (data preservation)
• ✅ SQL injection prevention (EF Core parameterized queries)

• Implement JWT authentication
• Add role-based access control (RBAC)
• Validate claims in AuthorizationBehavior
• Use HTTPS only

• Enable CORS with specific origins
• Implement rate limiting
• Add request size limits
• Validate Content-Type headers
• Implement API versioning

• Encrypt sensitive data at rest
• Use parameterized queries (already implemented)
• Implement audit logging
• Regular security updates

• Use HTTPS/TLS certificates
• Implement WAF (Web Application Firewall)
• Regular dependency updates
• Security scanning in CI/CD pipeline

• Use strong connection encryption
• Implement least privilege access
• Regular backups
• Database activity monitoring

# Check for outdated packages
dotnet outdated

# Update packages
dotnet package update

# Security scanning with NuGet
dotnet list package --deprecated
dotnet list package --vulnerable

• Never commit .env files
• Use Azure Key Vault or similar for production secrets
• Store connection strings securely
• Use environment variables for sensitive settings

• No sensitive data in version control
• Use user secrets for development:

dotnet user-secrets init
dotnet user-secrets set "ConnectionStrings:DefaultConnection" "your-connection-string"

• Code analysis (SonarQube recommended)
• Dependency scanning
• Secret detection
• Format validation

• Automated security tests
• Penetration testing
• Security scanning in pipeline
• Approval gates for production

• OWASP Top 10
• CWE/SANS Top 25
• GDPR considerations for EU users

• Implement data retention policies
• GDPR compliance if processing EU data
• Right to be forgotten implementation
• Data export capabilities

Recommended headers for production:

app.Use(async (context, next) =>
{
    context.Response.Headers.Add("X-Content-Type-Options", "nosniff");
    context.Response.Headers.Add("X-Frame-Options", "DENY");
    context.Response.Headers.Add("X-XSS-Protection", "1; mode=block");
    context.Response.Headers.Add("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
    await next();
});

Always pin exact versions in production:

<!-- ✅ Good -->
<PackageReference Include="MediatR" Version="12.0.1" />

<!-- ❌ Avoid -->
<PackageReference Include="MediatR" Version="12.0.*" />

• OWASP Security Guidelines
• .NET Security Best Practices
• ASP.NET Core Security
• NuGet Security

For security questions or concerns, contact the maintainers privately through appropriate channels.