Security Best Practices

SQL injection: always use parameterized queries (@param) or ORMs. Never concatenate user input into SQL.

Secrets: don't hardcode passwords or keys. Use User Secrets (dev), environment variables, Azure Key Vault, or the Windows Credential Manager. Encrypt config sections or use DPAPI (ProtectedData).

Passwords: hash with a slow algorithm (Rfc2898DeriveBytes.Pbkdf2, BCrypt.Net, ASP.NET Identity's PasswordHasher). Never store plain text or use MD5/SHA1.

Cryptography: use System.Security.Cryptography (Aes, RSA, SHA256, RandomNumberGenerator). Never invent your own crypto.

Input validation: validate type, length, format, and range. Use whitelists. Use DataAnnotations (<Required>, <Range>, <EmailAddress>).

File handling: sanitize paths (Path.GetFileName), prevent path traversal, limit upload sizes, scan for malware.

Deserialization: don't use BinaryFormatter. Validate JSON and XML inputs and disable DTD processing for untrusted XML (XmlReaderSettings.DtdProcessing = Prohibit).

Least privilege: don't run apps or services as administrator. Use Windows authentication for internal apps.

Dependencies: keep NuGet packages updated (dotnet list package --vulnerable), and enable Dependabot.

Logging: never log passwords, tokens, or full credit card numbers.

Office/VBA macros: sign macros, distrust macro-enabled files from untrusted sources, use Trusted Locations carefully.

Imports System.Security.Cryptography
Dim salt = RandomNumberGenerator.GetBytes(16)
Dim hash = Rfc2898DeriveBytes.Pbkdf2("P@ssw0rd", salt, 100_000, HashAlgorithmName.SHA256, 32)
Dim token = Convert.ToHexString(RandomNumberGenerator.GetBytes(32))