hygiene

name	hygiene
description	Guidance for input sanitization, output encoding, and security hygiene in .NET. USE FOR: preventing XSS attacks, SQL injection prevention, HTML/URL/JavaScript encoding, input validation, Content Security Policy headers, CSRF protection, secure HTTP headers. DO NOT USE FOR: authentication flows (use ASP.NET Core Identity), encryption at rest (use CryptoNet), authorization policies (use Casbin/Enforcer), or certificate management.
license	MIT
metadata	{"displayName":"Security Hygiene & Sanitization","author":"Tyler-R-Kendrick","version":"1.0.0"}
compatibility	["claude","copilot","cursor"]
references	[{"title":"Prevent Cross-Site Scripting (XSS) in ASP.NET Core","url":"https://learn.microsoft.com/en-us/aspnet/core/security/cross-site-scripting"},{"title":"ASP.NET Core Security Overview","url":"https://learn.microsoft.com/en-us/aspnet/core/security/"}]

Security Hygiene & Sanitization

Overview

Security hygiene covers the defensive coding practices that prevent common web vulnerabilities: cross-site scripting (XSS), SQL injection, cross-site request forgery (CSRF), header injection, and path traversal. In .NET, these protections come from built-in encoders (), parameterized queries, antiforgery tokens, and secure HTTP header middleware. Proper hygiene means validating all input at the boundary, encoding all output for its context, and applying defense-in-depth with HTTP security headers.