Topic
Security & Reliability
Defensive engineering for .NET APIs, including injection, denial of service, retries, rate limits, and failure-safe design.
Path Traversal Vulnerability in ASP.NET Core
A path traversal vulnerability lets user input escape a trusted directory. See the unsafe C# patterns, the containment check, and tests that prove it.
Read article →Idempotency in API design: surviving the retry you didn't send
Every serious client retries. How the idempotency key pattern and a database unique constraint keep a retried payment from becoming two charges.
Read article →Rate limiting algorithms: how token buckets forgive bursts
Rate limiting algorithms compared: why fixed windows leak double the limit, how token buckets forgive bursts, and what a good 429 response returns.
Read article →ReDoS: the innocent regex that can take down your API
Catastrophic backtracking turns an email regex into a denial of service: 30 characters, nearly a minute of CPU. Why nested quantifiers explode and how .NET lets you defuse them.
Read article →The OWASP Top 10 through a C# lens
A practical tour of the OWASP Top 10 for .NET developers: the ASP.NET Core and EF Core patterns behind broken access control, injection, SSRF, and overposting.
Read article →SQL injection is still alive, and it's hiding in your C#
SQL injection is supposedly solved, yet it's still in the OWASP Top 10. The C# patterns that keep it alive in EF Core and ADO.NET, and how to kill them.
Read article →