The .NET framework whose security you can prove.
Secure-by-construction building blocks for domain-driven, event-driven services, shipped with the evidence your auditor will ask for.
- OpenSSF Scorecard
- SLSA Build L3
- Sigstore-signed releases
- SBOM + provenance
- CodeQL + Semgrep on every PR
- 95% line coverage gate
Your first API
The template generates a four-layer API with the secure host, tests, Dockerfile and CI already wired. Authentication fails closed; security headers, rate limiting, problem details and OpenTelemetry come from the base class.
dotnet new install Aedis.Templatesdotnet new aedis-api -n Shopcd Shop && dotnet testpublic sealed class ApiHost : AedisApiHost{ protected override void ConfigureAuthentication( IServiceCollection services, IConfiguration config) => services.AddAedisKeycloakAuth(config);}20 controls, each one mapped
Every control names where it lives in the code and what it answers in OWASP Top 10, NIST CSF 2.0, ISO/IEC 27001:2022 Annex A.8 and MITRE ATT&CK. Source: docs/SECURITY-COMPLIANCE.md (external site).
| # | Control | OWASP 2021 | NIST CSF 2.0 | ISO 27001 A.8 | MITRE ATT&CK |
|---|---|---|---|---|---|
| 1 | Security headers (CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, COOP/CORP)SecurityHeadersMiddleware | A05 | PR.PS | A.8.9, A.8.23 | M1050 · T1185, T1059.007 |
| 2 | HSTS and HTTPS redirectionHttpsOptions | A02 | PR.DS-02 | A.8.24 | M1041 · T1557, T1040 |
| 3 | Rate limiting per client (user or IP)RateLimitingOptions | A04, A07 | PR.PS, DE.CM | A.8.6, A.8.20 | M1036 · T1110, T1499 |
| 4 | Host header protectionHostHeaderProtectionMiddleware | A05 | PR.PS | A.8.20, A.8.23 | T1190 |
| 5 | Trusted forwarded headers (real client IP and scheme)ForwardedHeadersHardeningOptions | A05 | PR.PS | A.8.20 | T1090 |
| 6 | Kestrel hardening (body and header limits, timeouts, no Server header)KestrelHardeningOptions | A05 | PR.PS | A.8.9 | M1037 · T1499, T1592 |
| 7 | Safe errors as ProblemDetails (no stack trace or internal message)GlobalExceptionHandlingMiddleware | A05, A09 | PR.PS, DE.CM | A.8.8 | T1592, T1210 |
| 8 | Input validation answered with 422AddAedisApiValidation | A03 | PR.PS | A.8.26, A.8.28 | T1190, T1059 |
| 9 | Fail-closed authentication gate: refuses to start insecure outside DevelopmentAedisApiHost | A01, A07 | PR.AA | A.8.5, A.8.26 | M1035 · T1078 |
| 10 | Deny-by-default authorization (the fallback policy requires an authenticated user)AedisApiHost | A01 | PR.AA-05 | A.8.3, A.8.5 | M1018, M1026 · T1078 |
| 11 | JWT validation (issuer, audience, lifetime; claims preserved)Aedis.Security.Keycloak | A07 | PR.AA-03 | A.8.5 | T1550.001 |
| 12 | Structured logging, OTLP telemetry and audit contextAedis.Observability.*, IAuditContext | A09 | DE.CM, DE.AE | A.8.15, A.8.16 | M1047 · detects T1110, T1078 |
| 13 | Graceful shutdown (drains requests, releases resources)Aedis.Diagnostics | A04 | PR.PS, RC.RP | A.8.14 | — |
| 14 | No OpenAPI documentation by default: opt-in package, mapped only in Development by the templateMapAedisOpenApi, MapAedisScalar | A05 | PR.PS | A.8.9 | T1592 |
| 15 | Deterministic build, central package management with fixed versions, vulnerable transitive overridesDirectory.*.props | A06, A08 | ID.RA, PR.PS | A.8.8, A.8.29, A.8.30 | T1195 |
| 16 | HTTPS-aware response compression (BREACH trade-off documented)AedisApiHost | — | — | — | — |
| 17 | Brute-force guard per credential with three configurable lockout tiers, keyed by target rather than IPIBruteForceGuard | A07 | PR.AA, DE.CM | A.8.5 | M1036 · T1110, T1110.003 |
| 18 | Token revocation: distributed denylist by jti or by user, abuse guard and admin endpointITokenDenylist, ITokenRevocation | A07, A01 | PR.AA-01, RS.MI | A.8.5 | M1018 · T1528, T1550.001 |
| 19 | Memory-safe managed code (no unsafe, no stackalloc); runtime ASLR, DEP, CFG and CET; opt-in AOT hardeningAedis.Build | A06 | PR.PS | A.8.28 | M1050 · T1203 |
| 20 | SSRF protection on outbound HTTP: internal and metadata addresses refused at connect time, immune to DNS rebindingSsrfPolicy (Aedis.Http) | A10 | PR.PS, PR.AC | A.8.20, A.8.23 | T1552.005, T1090, T1046 |
No library covers the organizational side: ISMS, policies, risk management, incident response. Aedis says so in the matrix and stops there: TLS, secret rotation, cluster hardening and backups stay with the operator.
What are you building?
An API or a worker
.NET packages: secure host, ports and adapters, messaging, secrets, signing. Moving cloud, broker or database is a package swap.
A screen
UI components from a shadcn-style registry. You copy the code into your app and own it.
The delivery pipeline
Platform: conformance levels L1 to L3 and a policy-based merge gate for your repositories.