A NuGet package doesn't need your code to call it to run arbitrary logic on your machine — MSBuild targets execute the moment you restore or build. Verified against the .NET 10 SDK with a lab-only PoC package and two tests: one proving the attack, one showing how package source mapping blocks it on a clean restore — plus the lock file and central package management controls that close the gaps mapping alone doesn't cover.

C# 14 lets extension blocks declare properties and static members — not just methods. That new surface comes with an old risk from a different angle: when a real member and an extension member share a name, the real member wins silently, with zero compiler warning. Verified against the .NET 10 SDK, including the exact diagnostics (CS9296, CS9339) a Roslyn-based test suite checks for.

A 2024 guide to CQRS with MediatR, rebuilt from scratch on .NET 10 instead of patched in place: what MediatR 14's license actually requires in practice, minimal API endpoints and IExceptionHandler replacing the original's placeholder exception behavior, SQLite in memory replacing a mocked DbContext in tests, the Native AOT limitations of reflection-based handler discovery, and a source-generated alternative that sidesteps the license question entirely.

An EF Core value converter can encrypt a database column before it reaches storage, but the entity comes back as ordinary C# strings the moment the application reads it — and System.Text.Json serializes those values exactly like everything else. Here's how a JsonTypeInfo modifier encrypts specific properties at the serialization boundary with AES-GCM, without touching the domain model or the database mapping, and where this control helps, where it doesn't, and why it has to work alongside data minimization and log redaction, not replace them.

Broken Object Level Authorization (BOLA) is OWASP's #1 API security risk, and [Authorize] does nothing to stop it: it confirms who the caller is, not whether they should see the object behind this specific ID. Here's how BOLA shows up in ASP.NET Core APIs, why EF Core global query filters aren't a full fix on their own, and how to close it with resource-based authorization and a test matrix that catches the regression before a pentest does.

Polly v8 didn't just add features to the v7 fluent policy API. It replaced the whole model: Policy.Handle<T>() and IAsyncPolicy are gone, and every strategy (retry, circuit breaker, timeout, fallback, hedging, rate limiting) now composes through one ResiliencePipelineBuilder. Here's what changed, the six built-in strategies, and how to test retries and circuit breakers without waiting for real delays.

The Claude Agent SDK (the package that turns Claude into an autonomous coding agent with tools, permissions, and a conversation loop) only ships officially for Python and TypeScript. In C#, the closest thing is buried inside the regular Anthropic SDK: a `ToolRunner` helper that drives the tool-use loop for you. Here's how to build a real file-editing, command-running agent with it, and where the unofficial alternatives fit.

OpenAI shipped GPT-6 Astra on September 3, 2026. Before wiring it into a .NET project, here's the actual API contract — context window, pricing, reasoning effort — checked against the live docs, plus what I found installing the real OpenAI NuGet package: the stable client can't do Astra's tool calling at all, the client that can is still experimental, and the SDK's named reasoning levels stop short of what the model documents.

OpenTelemetry gets the HTTP half of a distributed trace right automatically: two services, one trace, zero manual wiring. The interesting failure is one hop further, the moment the same request crosses into a queue. Two real ASP.NET Core services, a trace captured in Jaeger, and the exact boundary where context silently stops propagating unless you carry it across yourself.

Both .NET 8 and .NET 9 stop getting security patches on November 10, 2026 — same date, despite one being LTS and the other STS. Bumping TargetFramework takes five seconds. Finding out what changed underneath it takes longer: EF Core's query translation, whether one failing BackgroundService blocks every other one from starting, and how SQLite reinterprets a DateTimeOffset it's never seen before. I ran every item on this list myself, on both SDKs side by side, before writing any of it down.

Every provider SDK — OpenAI, Azure OpenAI, Ollama, Anthropic — has its own client, its own message types, its own way of doing tool calling. Microsoft.Extensions.AI collapses all of that behind a single IChatClient interface, with DI-friendly middleware for caching, telemetry, and function invocation built in. Here's how the abstraction actually works.

ASP.NET Core Identity in .NET 10 ships built-in WebAuthn/FIDO2 passkey support. Here's how registration and sign-in actually work under the hood, what MakePasskeyCreationOptionsAsync and PasskeySignInAsync do for you, and where the implementation deliberately stops short of a full WebAuthn library.

C# is finally getting union types. After a decade of sealed-class workarounds and OneOf packages, C# 15 ships real unions and closed hierarchies in the .NET 11 preview. Here's what they look like, when to reach for each, and the gotchas the announcement posts won't tell you about.

Most legacy .NET applications don't need a rewrite — they need a plan. Here's how to move a real enterprise codebase from .NET Framework to modern .NET without stopping feature work: async-first data access, structured logging, Polly resilience, health checks, and the strangler fig pattern done right.

Uncle Bob described a multi-agent pipeline where human interaction decreases at each stage — Specifier, Coder, Refactorer, Architect — transforming informal requirements into mutation-tested, property-verified code. Here's what each stage does and how to implement it in .NET.

IMemoryCache is fast but per-server. IDistributedCache is shared but slow and full of boilerplate. .NET 9's HybridCache combines both into one API — two-tier caching, built-in stampede protection and tag invalidation. Here's how to use it properly.

We've built the location pipeline and the trip state machine. Now we connect them: find the nearest available driver, calculate surge pricing, and trace the full lifecycle from rider request to completed trip.

A trip isn't just data — it's a lifecycle. Requested, assigned, en route, completed, cancelled. Get the transitions wrong and two drivers accept the same ride, or a payment fires twice. Here's how to model it correctly in .NET.

Uber processes millions of GPS updates every second. Here's how to build the same real-time location tracking pipeline in .NET — from driver updates to rider map — using Redis GEO, a mutable state buffer and SignalR.

MediatR went commercial and half the .NET world started looking for an exit. The good news: CQRS was never about MediatR. Here's how to build clean, testable command and query handlers using nothing but the built-in DI container.

Every external API you consume is a ticking bomb. A model change, a renamed field, a deprecated endpoint — and suddenly your domain logic is full of someone else's concepts. Here's how the Anti-Corruption Layer pattern keeps your domain clean.

One /health endpoint is not enough for Kubernetes. Learn how to configure Liveness, Readiness, and Startup probes correctly in .NET — with tagged Health Checks, production YAML, common mistakes, and the reasoning behind every parameter.

Most developers add a /health endpoint and call it done. Here's how to build health checks that actually tell you what's wrong — database, external APIs, disk space, and Kubernetes probes, all in production-ready code.

Master IAsyncEnumerable to handle large datasets efficiently. Learn production patterns with Entity Framework, HttpClient streaming, and real performance comparisons.

Direct Supabase calls from the frontend in The Coffee Timer were triggering 429 errors under load. Here's how moving critical operations to a .NET backend, using Supabase RPCs, server-side caching, and a localStorage TTL fixed it for good.

Unhandled exceptions in .NET APIs expose stack traces, database schemas, and internal paths to anyone watching. Learn how to implement secure error handling in ASP.NET Core to protect your application without sacrificing observability.

Learn how to set up a complete CI/CD pipeline for your .NET applications using GitHub Actions — from building and testing on every push to deploying Docker containers to Azure

Learn why asynchronous messaging matters in .NET applications, how queues and topics differ, and when to use RabbitMQ, Azure Service Bus, or AWS SQS to build reliable, decoupled systems

Learn how to connect PostgreSQL to your .NET application using Entity Framework Core and Dapper, set up Docker locally, run migrations, and leverage PostgreSQL-specific features like JSONB, arrays, and enum types

Learn how Vertical Slice Architecture organizes code by features instead of layers, reducing coupling and accelerating development in .NET applications

ExecuteUpdate and ExecuteDelete provide 300-500x performance improvements for bulk operations, eliminating the need to load thousands of entities into memory

EF Core 10 finally introduces native LeftJoin and RightJoin LINQ operators, replacing the verbose GroupJoin + DefaultIfEmpty pattern with clean, readable code

Learn how to implement the Result Pattern for cleaner error handling without exceptions. Discover when to use it, how to build it from scratch, and integrate it with ASP.NET Core Minimal APIs.

Discover the new built-in validation support for Minimal APIs in .NET 10. Learn how to use DataAnnotations, custom validation attributes, and IValidatableObject without external packages.

Learn how to build high-performance, thread-safe producer-consumer applications using System.Threading.Channels. Explore bounded and unbounded channels, backpressure strategies, and real-world implementation patterns.

Learn how to build MCP servers and clients in C# using the official SDK, and connect your .NET applications with AI models in a standard, scalable way.

Discover how the new field keyword in C# 14 eliminates boilerplate code and provides an elegant middle ground between auto-properties and full properties. Learn practical use cases including validation, lazy initialisation, and INotifyPropertyChanged.

Learn the Adapter Pattern through practical .NET examples: payment gateways, logging systems, and legacy code integration. Understand when and how to use this essential structural design pattern.

Should you use the Repository Pattern or work directly with DbContext? Explore both approaches with practical examples, performance benchmarks, and real-world scenarios to make the right choice for your .NET projects.

A clear and practical guide to understanding Task vs ValueTask in .NET, with benchmarks, examples, rules of thumb, and real-world recommendations.

Master the most powerful shorthand operators in modern C# that will transform your code. From fundamentals to C# 13 features, learn how to write cleaner, more efficient code that stands out.

Learn to run artificial intelligence models completely offline with C# and .NET using llama.cpp and LLamaSharp. Control your data, avoid API costs, and build your own local assistant step by step.

Comprehensive guide to constructors in C#. Learn the 7 essential constructor types: default, parameterised, copy, static, private, chaining, and optional parameters. Includes practical examples, use cases, and best practices for object initialisation in C#.

Complete guide to AutoMapper in C#. Learn advanced mapping techniques: nested mappings, custom resolvers, value converters, projection with Entity Framework, testing strategies, performance optimisation, and common pitfalls. Includes practical examples and best practices.

Complete guide to unit testing in C#. Learn all types of tests: basic unit tests, mocks, parametrised tests, async testing, property-based testing, and best practices. Includes practical examples with xUnit, NUnit, Moq, and advanced techniques.

Learn how to implement rate limiting in ASP.NET Core to protect your APIs from abuse, DDoS attacks, and excessive usage. Includes native .NET 7+ features, custom implementations, Redis distributed scenarios, and benchmarks.

Learn how to improve query performance in your .NET applications using database indexing with Entity Framework Core. Includes examples with Fluent API, Data Annotations, migrations, and a benchmark.

Learn how to build a smart API with .NET Core, SQLite, and OpenAI to perform semantic search using embeddings. A practical guide for beginners who want to integrate AI into real-world applications.

Decouple your ASP.NET Core applications using the Mediator pattern and MediatR. This guide shows how to structure your code for maintainability, testability, and clean architecture with real-world examples and pipeline behaviours.

Learn how to use a SQL Server database as a configuration source in ASP.NET Core. This guide covers custom providers, dynamic reload support, and best practices for secure, scalable config management.

Avoid database drift and deployment surprises by learning how to detect and prevent missing migrations in Entity Framework Core. Includes automated checks, runtime guards, and CI-friendly scripts.

Learn how to apply Domain-Driven Design in .NET to create expressive, maintainable, and business-focused domain models. Includes practical examples with Value Objects, Aggregates, Repositories, and tests.

A practical guide to diagnosing and optimising .NET applications in real-world environments. Learn what to measure, which tools to use, and the best practices for making .NET applications faster, more predictable, and more resilient.

Learn the best practices to handle secrets in .NET applications using environment variables, user secrets, configuration files, and Azure Key Vault. Keep your credentials safe and your architecture clean.

Explore Core-Driven Architecture to keep your business domain isolated and clean. Learn how to build maintainable, scalable, and testable .NET applications by focusing on core business logic and clear separation of concerns.

Accessing elements by index is fast but risky in production .NET code. Learn safer and more expressive alternatives to avoid runtime exceptions, fragile logic, and unclear intent. Includes benchmarks, real-world examples, and a diagram.

MVVM is a powerful architectural pattern used in .NET desktop applications like WPF, MAUI, and WinUI. In this article, we break down the pattern with a practical example, a diagram, its pros and cons, and step-by-step instructions to build it in Visual Studio Code.

Protecting sensitive data is a critical requirement in any modern application. Whether it’s personal information, passwords, or API keys, we must ensure that stored data isn’t left in plain text in case of a breach.

Abstractions make our code elegant and modular — but they're not free. In this article, we explore how some common abstractions in .NET can hurt performance if used carelessly, and how to avoid the hidden costs.

Building a working API is one thing — building a *fast and efficient* API is another. As your application scales or handles more users, performance becomes a critical concern.

Learn how to reduce GC pressure in your .NET applications using structs, ArrayPool<T>, and smart memory patterns.

Reading files is a fundamental skill in C#, and knowing the right method can improve both performance and readability. This article explores various ways to read text files, from the simplest to the most efficient, with practical code examples and guidance.

In modern applications, especially web and desktop apps, executing long-running tasks on the main thread can block user interactions or degrade performance. That’s where background tasks come in.

Learn how to add localization support to your ASP.NET Core application, enabling multiple languages and culture-specific features.

Learn how to build a RESTful API using .NET and MongoDB, with a focus on implementing pagination to efficiently manage large datasets.

The .NET ecosystem keeps evolving, and with the release of C# 14 alongside .NET 10, developers now have a fresh set of features that make the language even more expressive, concise, and powerful. In this post, I’ll walk you through the key improvements in this new version, with clear and practical examples.

Security is one of the most critical aspects of modern application development. In an era where data breaches and cyber threats are increasingly common, securing your .NET applications is not optional – it’s essential. This guide covers practical strategies and tools you can apply right now to make your applications safer and more resilient.

Multithreading in C# might sound intimidating at first, but once you get the hang of it, it becomes a superpower for writing responsive, efficient, and modern applications. Whether you're building a UI that shouldn't freeze or handling heavy background work in a backend service, multithreading can help.

Dapper is a lightweight micro-ORM for .NET that offers high-speed data access while keeping things simple. Unlike full-fledged ORMs like Entity Framework, Dapper focuses on raw SQL execution with minimal overhead. If you're working on an application where performance matters, Dapper can be a great choice.

If you work with .NET and asynchronous tasks, you've probably encountered the need to cancel an ongoing operation. This is where Cancellation Tokens (CancellationToken) come into play, a crucial tool for improving performance and responsiveness in your applications. When dealing with long-running tasks like database queries, HTTP requests, or CPU-intensive processes, it’s important to be able to stop them if they’re no longer necessary. This prevents wasting resources and makes your application more efficient.

In this article, we’ll explore 9 ways to set the URLs for your ASP.NET Core app, with practical examples to help you decide which method suits your needs.

Designing a good RESTful API remains a crucial part of modern application development. With the rise of mobile applications, distributed architectures, and microservices, creating APIs that are easy to use, efficient, and secure is more important than ever. This article will explore 12 best practices for building REST APIs, focusing on C# .NET.

Uploading images in Next.js is a common task when developing web applications.

In C#, there are two main options for creating APIs: SOAP (Simple Object Access Protocol) and REST (Representational State Transfer).

Installation and configuration of docker for Dotnet 8 and React, I have also added some commands that will help us.

Asynchrony is an essential tool in modern programming, designed to enhance the efficiency and responsiveness of applications.