Security

Mitigation in VB.NET Parameters / EF / Dapper parameters, never string concatenation

User Secrets, environment variables, Key Vault, DPAPI (ProtectedData), no secrets in source control Weak password storage

Rfc2898DeriveBytes.Pbkdf2 (100k+ iterations, SHA-256), BCrypt/Argon2 libraries

Aes/AesGcm (with authentication), RSA/ECDsa, SHA256/SHA512, RandomNumberGenerator. Never MD5/SHA1/DES for security.

No BinaryFormatter. Safe JSON settings. Validate types.

DtdProcessing.Prohibit, XmlResolver = Nothing Path.GetFullPath + verify it's under the allowed root, Path.GetFileName for uploads

Regex timeouts, RegexOptions.NonBacktracking (.NET 7) ProcessStartInfo.ArgumentList (no shell concatenation)

dotnet list package --vulnerable, Dependabot, NuGet audit (<NuGetAudit>)

Windows auth, Microsoft Entra ID (MSAL), ASP.NET Core Identity / JWT for APIs, role/claim checks Tampering of binaries

Code signing (Authenticode), strong integrity checks for updates Logging sensitive data Redact PII, tokens, passwords

Secure SDLC: threat modeling, code review checklists, static analysis (Roslyn security analyzers, SonarQube, GitHub CodeQL, which supports VB analysis in some configurations), least privilege for services, OWASP guidance.

Imports System.Security.Cryptography
Public Module PasswordHasher
    Public Function Hash(password As String) As String
        Dim salt = RandomNumberGenerator.GetBytes(16)
        Dim key = Rfc2898DeriveBytes.Pbkdf2(password, salt, 210_000, HashAlgorithmName.SHA256, 32)
        Return $"{Convert.ToBase64String(salt)}.{Convert.ToBase64String(key)}"
    End Function
    Public Function Verify(password As String, stored As String) As Boolean
        Dim parts = stored.Split("."c)
        Dim salt = Convert.FromBase64String(parts(0))
        Dim expected = Convert.FromBase64String(parts(1))
        Dim actual = Rfc2898DeriveBytes.Pbkdf2(password, salt, 210_000, HashAlgorithmName.SHA256, 32)
        Return CryptographicOperations.FixedTimeEquals(actual, expected)
    End Function
End Module