skills.rest
peterblazejewicz
peterblazejewiczCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-and-hardening

Hardens .NET and C# applications against OWASP vulnerabilities with validation, authentication, and secrets guidance.

7|Updated Jan 11, 2026
Search Tags:#security#authentication#owasp#dotnet#hardening#ef-core#aspnet-core
One-click install
npx skills add https://github.com/peterblazejewicz/claude-plugins --skill security-and-hardening-peterblazejewicz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-and-hardening
Source: https://github.com/peterblazejewicz/claude-plugins/tree/main/plugins/dotnet-skills/skills/security-and-hardening
Command: npx skills add https://github.com/peterblazejewicz/claude-plugins --skill security-and-hardening-peterblazejewicz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? .NET applications that accept user input, handle authentication, or store sensitive data are exposed to injection, XSS, broken access control, SSRF, and secret leakage. This Skill provides concrete, code-level hardening patterns so security controls are built into every feature rather than bolted on afterward. ## Core Features & Use Cases - Threat modeling and OWASP coverage: STRIDE-based trust boundary analysis plus prevention patterns for injection, broken authentication, XSS, broken access control, misconfiguration, sensitive data exposure, and SSRF in ASP.NET Core, Blazor, and EF Core. - Secure implementation patterns: FluentValidation boundary validation, parameterized EF Core queries (FromSql vs FromSqlRaw), ASP.NET Core Identity and JWT bearer configuration, policy-based authorization, rate limiting, file upload magic-byte checks, and Data Protection usage. - Secrets and supply-chain hygiene: user-secrets and Azure Key Vault workflows, dotnet list package --vulnerable triage, lock files, package source mapping, and LLM/AI feature hardening per the OWASP LLM Top 10. - Use Case: While building a new Minimal API endpoint that accepts file uploads and calls an external webhook URL, activate this Skill to get validation, SSRF defenses, antiforgery, and rate-limiting code before writing the handler. ## Quick Start Ask the assistant to review your ASP.NET Core endpoint or authentication setup for security vulnerabilities and apply the recommended hardening patterns.

Frequently Asked Questions about security-and-hardening

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent SQL injection in EF Core raw SQL queries?▼

Use LINQ whenever possible since EF Core parameterizes automatically. For raw SQL on EF Core 8+, use FromSql with an interpolated string, or FromSqlInterpolated on earlier versions; both take a FormattableString and parameterize each hole. Never use FromSqlRaw with an interpolated string, because C# formats it before EF Core sees the query.

How do I validate user input in ASP.NET Core Minimal APIs?▼

Define a FluentValidation AbstractValidator for each input record, inject IValidator<T> into the endpoint, and return Results.ValidationProblem when validation fails. This enforces schema validation at the system boundary before any business logic runs.

Does this guidance apply to Blazor WebAssembly and Avalonia apps?▼

Cross-cutting items like secret handling, parameterized queries, and avoiding BinaryFormatter apply to any .NET host including Avalonia and MAUI. Client-specific guidance is included, such as never storing auth tokens in Blazor WebAssembly localStorage and re-validating on the server.

How should I triage dotnet list package --vulnerable results?▼

Check severity first: critical or high vulnerabilities reachable in your code path need immediate fixes, while dev-only or unreachable findings can be scheduled. If no fix exists, replace the package, apply a workaround, or document an allowlist entry with a review date.

What should I do if a secret was committed to git?▼

Rotate the secret immediately by revoking and reissuing the key, since deleting the line or rewriting history is not enough once it reaches a remote. After rotation, purge it from history and add pre-commit hooks that scan staged changes for secrets.

How do I secure LLM features built with Semantic Kernel or Azure OpenAI?▼

Treat all model output as untrusted input: never pass it to FromSqlRaw, Process.Start, or MarkupString without validation. Enforce permissions in code rather than prompts, keep secrets out of context, constrain tool permissions, and cap token usage and loop depth.

Related Skills

Explore More Software Engineering Skills→
foutoucourfoutoucour

threat-model

Identify and mitigate STRIDE threats across application architectures.

Community
Advanced
paulundpaulund

security-reviewer

Identify and report security vulnerabilities in code, configurations, and infrastructure.

Community
Advanced
ArabelaTsoArabelaTso
142

security-sensitive-path-instrumenter

Add structured logging to authentication, authorization, and input-handling code paths.

Community
Intermediate
HenderOrlandoHenderOrlando

seguridad-avanzada

Implement advanced IAM, session controls, anomaly detection, and KMS encryption.

Community
Advanced