Broken Object Level Authorization (BOLA) is OWASP's #1 API security risk, and [Authorize] does nothing to stop it: it confirms who the caller is, not whether they should see the object behind this specific ID. Here's how BOLA shows up in ASP.NET Core APIs, why EF Core global query filters aren't a full fix on their own, and how to close it with resource-based authorization and a test matrix that catches the regression before a pentest does.

Polly v8 didn't just add features to the v7 fluent policy API. It replaced the whole model: Policy.Handle<T>() and IAsyncPolicy are gone, and every strategy (retry, circuit breaker, timeout, fallback, hedging, rate limiting) now composes through one ResiliencePipelineBuilder. Here's what changed, the six built-in strategies, and how to test retries and circuit breakers without waiting for real delays.

The Claude Agent SDK (the package that turns Claude into an autonomous coding agent with tools, permissions, and a conversation loop) only ships officially for Python and TypeScript. In C#, the closest thing is buried inside the regular Anthropic SDK: a `ToolRunner` helper that drives the tool-use loop for you. Here's how to build a real file-editing, command-running agent with it, and where the unofficial alternatives fit.

Stable Chat Completions, the Microsoft.Extensions.AI bridge, and the still-experimental Responses API against GPT-6 Astra, side by side behind one CLI arg each. Companion repo for the article.

A Pomodoro-style focus timer with task tracking, visual themes, and premium features like Spotify playback and a productivity calendar. Backend on .NET with Supabase, subscription checks handled server-side.

Before/after demo for migrating enterprise .NET apps to modern .NET — async, DI, EF Core Code First, Polly v8, health checks, Serilog, and the Strangler Fig pattern. Companion repo for the article.