IoTSpy

Senior .NET engineering guidance for ASP.NET Core, EF Core, SignalR, Polly, auth, testing, and observability. Use when designing or debugging .NET code, choosing between library options, planning a migration, or asked how something in the .NET ecosystem actually behaves.

IoTSpy project context — architecture, conventions, and security caveats specific to this codebase. Use when working in the IoTSpy repo, especially alongside dotnet-engineer, security-code-review, or threat-modeling. Pointers into in-repo docs rather than duplicated facts that rot.

Systematic security review across the full attack surface — input handling, authorization, resource use, errors, crypto, secrets, and dependencies. Use when asked to review code for security, audit an endpoint, or check whether something is safe before merging. Also trigger on "is this OK?" / "any issues here?" — security bugs hide in code that looks fine.

Structured threat modeling for systems, features, and architecture changes — STRIDE plus OWASP/ATT&CK, calibrated by impact and likelihood. Use when asked for a threat model or design security review, or when someone describes a design and asks "is this secure?" / "how could this be abused?" / "what could go wrong?"