security-review

Use EF Core LINQ queries, which are parameterized by default, and never concatenate user input into SQL strings. For raw SQL, use FromSqlInterpolated or SqlParameter, and validate dynamic sort or filter fields against a whitelist.

SCA tools like Dependabot and npm audit alert you to currently known vulnerabilities in dependencies. An SBOM is a static, archivable inventory of all components (SPDX 2.2 format) used for compliance, incident response, and retroactive queries; the two are complementary, not redundant.

ERROR-severity findings block PRs: fix true positives using secure code patterns, and suppress false positives via .semgrepignore or inline nosemgrep comments with a review date. Findings involving payment data or PII require immediate remediation and compliance checks.

Store JWT tokens in httpOnly cookies, not localStorage, to prevent XSS-based token theft. Configure cookies with Secure and SameSite attributes, and use JWT Bearer tokens for API endpoints which are naturally CSRF-immune.

Trivy and Syft do not parse bare .csproj files without packages.lock.json, producing silently empty .NET SBOMs. Microsoft sbom-tool uses component-detection that natively parses bare .csproj files, making it suitable for NuGet plus npm projects.

Use Microsoft.AspNetCore.RateLimiting with fixed window limiters, applying stricter limits to expensive operations like login, search, or PDF generation. Combine IP-based and user-based limiting, and annotate controllers with EnableRateLimiting attributes.