What problem does it solve? ASP.NET Core backends often ship with exploitable gaps: regex-based HTML sanitizers that are trivially bypassed, JWTs that cannot be revoked, login endpoints without rate limiting, and file uploads vulnerable to polyglot attacks. This Skill provides a verified, attacker-perspective workflow to find and fix these issues in your own codebase. ## Core Features & Use Cases - Threat modeling and security review: Maps trust boundaries, high-value assets, and attacker models, then produces a severity-ranked report (HIGH/MED/MINOR/NIT) with CWE references, attack paths, fixes, and verification steps. - Concrete hardening recipes: Parser-level HTML sanitization with Ganss.Xss HtmlSanitizer, layered media upload validation with ImageSharp re-encoding, JWT jti revocation with algorithm whitelisting, and net8 built-in rate limiting with lazy IOptions reads. - Supply-chain CI gates: NuGet vulnerability JSON gating, SQLitePCLRaw CVE pinning, workflow security contract tests, and no-token gitleaks scanning. - Use Case: You are open-sourcing an ASP.NET Core blog API with comments and image uploads. Use this Skill to audit the codebase, replace the regex sanitizer, add login rate limiting and JWT logout, and gate CI on dependency vulnerabilities. ## Quick Start Ask the agent to perform a security review of your ASP.NET Core API covering authentication, comments, and file uploads, and produce a severity-ranked hardening report.
