sota-dotnetlisted
State-of-the-art C# / .NET engineering rules (2026 baseline, .NET 10 LTS / C# 14) that Claude applies when writing or auditing .NET code. Covers modern idioms (records, nullable reference types, pattern matching, spans, file-scoped namespaces), API/null/immutability/`IDisposable` design, async/await & concurrency (ConfigureAwait, channels, cancellation, TPL), security (OWASP .NET, deserialization — BinaryFormatter removed in .NET 9, EF/Dapper SQL injection, ASP.NET Core auth, Data Protection, crypto), performance (GC, Span<T>/Memory<T>, BenchmarkDotNet, Native AOT), and build/tooling/CI (dotnet CLI, NuGet lockfiles & supply chain, Roslyn analyzers, nullable). Trigger keywords - C#, .NET, dotnet, ASP.NET Core, async, await, Task, record, nullable reference types, Span, EF Core, Dapper, LINQ, NuGet, Roslyn analyzer, BinaryFormatter, Native AOT, BenchmarkDotNet, IDisposable, ConfigureAwait. Use for BOTH building .NET services/libraries and auditing them.
martinholovsky/SOTA-skills · ★ 8 · AI & Automation · score 75
Install: claude install-skill martinholovsky/SOTA-skills
# SOTA C# / .NET (2026)
Expert-level rules for producing and auditing production .NET. The runtime is
memory-safe, so risk concentrates in **injection, deserialization, async
correctness, and dependency supply chain**. Baseline: **.NET 10 LTS** (released
Nov 2025, supported to Nov 2028) and **C# 14** (records, nullable reference
types, pattern matching, spans, extension members, the `field` keyword) — flag
where a control needs a specific version. Every rule states the *why*; every
rules file ends with an audit checklist of grep/analyzer patterns.
## Purpose
Two consumers, one source of truth:
- **BUILD mode** — generating C#/.NET: follow the rules as defaults. Enable
**nullable reference types** and treat analyzer warnings as errors; prefer
immutability and the async-all-the-way model. Deviate only with a comment.
- **AUDIT mode** — reviewing existing code: hunt violations with the audit
checklists, classify by severity, report in the finding format below. SQL
string-building and legacy deserialization are presumed exploitable.
## BUILD mode
1. Before writing, read the rules files relevant to the task (see index). A web
API touching untrusted input + a DB + async needs `02`, `03`, `04`.
2. Apply the **top-10 non-negotiables** (below) unconditionally.
3. New projects: target the current LTS (`net10.0`), `<Nullable>enable</Nullable>`,
`<TreatWarningsAsErrors>true</TreatWarningsAsErrors>`,
`<AnalysisLevel>latest-Recommended</AnalysisLevel>`, NuGet lockfil