📦

Audit History

dotnet-backend-patterns - 7 audits

Version comparison

Capability and finding changes across audited versions, newest first.

VersionDateResultReview itemsChange vs previous
v7 LatestJul 7, 2026, 07:39 AM No confirmed findings0No capability change
v6 Jul 7, 2026, 07:39 AM No confirmed findings0External commandsFilesystem access
v5 Jul 1, 2026, 12:18 AM 1 confirmed0 External commandsFilesystem access
v4 Jan 17, 2026, 08:32 AM No confirmed findings0No capability change
v3 Jan 17, 2026, 08:32 AM No confirmed findings0External commandsFilesystem access
v2 Jan 4, 2026, 05:09 PM No confirmed findings0No capability change
v1 Jan 4, 2026, 05:09 PM No confirmed findings0Baseline

Jul 7, 2026, 07:39 AM

The audit found no confirmed security issues after manual adjudication. Static alerts are false positives caused by Markdown code fences, C# syntax, .NET prose, and educational database examples. No evidence found for prompt injection, malicious command execution, data exfiltration, or host reconnaissance.

5
Files scanned
2,578
Lines analyzed
2
Review items
0
False positives ignored
Audited by: codex

Jul 7, 2026, 07:39 AM

The audit found no confirmed security issues after manual adjudication. Static alerts are false positives caused by Markdown code fences, C# syntax, .NET prose, and educational database examples. No evidence found for prompt injection, malicious command execution, data exfiltration, or host reconnaissance.

5
Files scanned
2,578
Lines analyzed
2
Review items
0
False positives ignored
Audited by: codex

Jul 1, 2026, 12:18 AM

Static analysis reported many high-risk patterns, but review found Markdown code fences, C# examples, and ordinary .NET identifiers misclassified as shell execution, reconnaissance, or weak cryptography. No prompt injection, malware intent, credential exfiltration, install scripts, or hidden executable behavior was found. The only real caution is an intentionally unsafe SQL example that is clearly labeled as an anti-pattern and followed by a parameterized replacement.

5
Files scanned
2,578
Lines analyzed
1
Review items
3
False positives ignored

Confirmed security concerns (1)

Low
Labeled SQL Injection Anti-Pattern Included for Teaching
The Dapper reference includes a string-interpolated SQL query as a bad example, immediately followed by a parameterized query. This is safe as documentation, but users should not copy the bad example into production code.
The unsafe SQL pattern is present, but it is explicitly labeled as bad and paired with a safe replacement. The risk is educational misuse, not malicious package behavior.
Static false positives ignored (3)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low
Static External Command Findings Are Markdown Examples
The reported Ruby or shell backtick execution locations are Markdown code fences around C# examples. They do not execute commands, launch processes, or request shell access.
The flagged lines are Markdown fences and C# snippets. I found no shell command invocation or executable script behavior at those locations.
Low
Weak Cryptography Alerts Are C# and Documentation Terms
The weak cryptography alerts point to words such as .NET, Design, Split Queries, Includes, and JsonSerializer examples. They are not MD5, SHA1, DES, or other weak cryptographic algorithm usage.
The referenced code and headings contain query specification properties, JSON serialization examples, and documentation text. No cryptographic API or hashing algorithm is used there.
Low
Reconnaissance and Hidden File Alerts Are Benign .NET Text
The system reconnaissance and hidden file alerts are caused by ordinary C# names, documentation text, and the .NET term in the skill description. They do not inspect the host system or access hidden files.
The flagged lines are educational C# database and async examples. I found no file enumeration, environment probing, or hidden path access behavior.

Detected Patterns

Do Not Copy String-Interpolated SQL Anti-Pattern
Audited by: codex

Jan 17, 2026, 08:32 AM

This is a pure documentation and code template skill containing only educational C#/.NET patterns. Static findings are 100% false positives caused by the scanner misidentifying: (1) markdown code fences as Ruby backticks, (2) SQL/database patterns as cryptographic terms, (3) standard C# namespace imports as reconnaissance. No executable code, network calls, file system access, or command execution exists. All content is static educational material.

6
Files scanned
2,791
Lines analyzed
2
Review items
0
False positives ignored

Risk Factors

⚙️ External commands (85)
references/dapper-patterns.md:32-59 references/dapper-patterns.md:59-63 references/dapper-patterns.md:63-85 references/dapper-patterns.md:85-91 references/dapper-patterns.md:91-133 references/dapper-patterns.md:133-137 references/dapper-patterns.md:137-177 references/dapper-patterns.md:177-181 references/dapper-patterns.md:181-246 references/dapper-patterns.md:246-250 references/dapper-patterns.md:250-278 references/dapper-patterns.md:278-284 references/dapper-patterns.md:284-308 references/dapper-patterns.md:308-312 references/dapper-patterns.md:312-348 references/dapper-patterns.md:348-352 references/dapper-patterns.md:352-397 references/dapper-patterns.md:397-401 references/dapper-patterns.md:401-429 references/dapper-patterns.md:429-435 references/dapper-patterns.md:435-443 references/dapper-patterns.md:443-447 references/dapper-patterns.md:447-458 references/dapper-patterns.md:458-462 references/dapper-patterns.md:462-468 references/dapper-patterns.md:468-474 references/dapper-patterns.md:474-517 references/dapper-patterns.md:517-521 references/dapper-patterns.md:521-544 references/ef-core-best-practices.md:9-20 references/ef-core-best-practices.md:20-24 references/ef-core-best-practices.md:24-41 references/ef-core-best-practices.md:41-45 references/ef-core-best-practices.md:45-64 references/ef-core-best-practices.md:64-68 references/ef-core-best-practices.md:68-78 references/ef-core-best-practices.md:78-82 references/ef-core-best-practices.md:82-100 references/ef-core-best-practices.md:100-106 references/ef-core-best-practices.md:106-130 references/ef-core-best-practices.md:130-134 references/ef-core-best-practices.md:134-147 references/ef-core-best-practices.md:147-153 references/ef-core-best-practices.md:153-176 references/ef-core-best-practices.md:176-180 references/ef-core-best-practices.md:180-188 references/ef-core-best-practices.md:188-194 references/ef-core-best-practices.md:194-228 references/ef-core-best-practices.md:228-232 references/ef-core-best-practices.md:232-253 references/ef-core-best-practices.md:253-259 references/ef-core-best-practices.md:259-280 references/ef-core-best-practices.md:280-286 references/ef-core-best-practices.md:286-295 references/ef-core-best-practices.md:295-299 references/ef-core-best-practices.md:299-315 references/ef-core-best-practices.md:315-319 references/ef-core-best-practices.md:319-329 references/ef-core-best-practices.md:329-333 references/ef-core-best-practices.md:333-355 SKILL.md:25-47 SKILL.md:47-51 SKILL.md:51-101 SKILL.md:101-105 SKILL.md:105-150 SKILL.md:150-154 SKILL.md:154-227 SKILL.md:227-231 SKILL.md:231-293 SKILL.md:293-299 SKILL.md:299-374 SKILL.md:374-378 SKILL.md:378-478 SKILL.md:478-484 SKILL.md:484-597 SKILL.md:597-603 SKILL.md:603-708 SKILL.md:708-712 SKILL.md:712-772 SKILL.md:772-789 SKILL.md:789 SKILL.md:789-794 SKILL.md:794-796 SKILL.md:796-802 SKILL.md:802-803
📁 Filesystem access (2)
Audited by: claude

Jan 17, 2026, 08:32 AM

This is a pure documentation and code template skill containing only educational C#/.NET patterns. Static findings are 100% false positives caused by the scanner misidentifying: (1) markdown code fences as Ruby backticks, (2) SQL/database patterns as cryptographic terms, (3) standard C# namespace imports as reconnaissance. No executable code, network calls, file system access, or command execution exists. All content is static educational material.

6
Files scanned
2,791
Lines analyzed
2
Review items
0
False positives ignored

Risk Factors

⚙️ External commands (85)
references/dapper-patterns.md:32-59 references/dapper-patterns.md:59-63 references/dapper-patterns.md:63-85 references/dapper-patterns.md:85-91 references/dapper-patterns.md:91-133 references/dapper-patterns.md:133-137 references/dapper-patterns.md:137-177 references/dapper-patterns.md:177-181 references/dapper-patterns.md:181-246 references/dapper-patterns.md:246-250 references/dapper-patterns.md:250-278 references/dapper-patterns.md:278-284 references/dapper-patterns.md:284-308 references/dapper-patterns.md:308-312 references/dapper-patterns.md:312-348 references/dapper-patterns.md:348-352 references/dapper-patterns.md:352-397 references/dapper-patterns.md:397-401 references/dapper-patterns.md:401-429 references/dapper-patterns.md:429-435 references/dapper-patterns.md:435-443 references/dapper-patterns.md:443-447 references/dapper-patterns.md:447-458 references/dapper-patterns.md:458-462 references/dapper-patterns.md:462-468 references/dapper-patterns.md:468-474 references/dapper-patterns.md:474-517 references/dapper-patterns.md:517-521 references/dapper-patterns.md:521-544 references/ef-core-best-practices.md:9-20 references/ef-core-best-practices.md:20-24 references/ef-core-best-practices.md:24-41 references/ef-core-best-practices.md:41-45 references/ef-core-best-practices.md:45-64 references/ef-core-best-practices.md:64-68 references/ef-core-best-practices.md:68-78 references/ef-core-best-practices.md:78-82 references/ef-core-best-practices.md:82-100 references/ef-core-best-practices.md:100-106 references/ef-core-best-practices.md:106-130 references/ef-core-best-practices.md:130-134 references/ef-core-best-practices.md:134-147 references/ef-core-best-practices.md:147-153 references/ef-core-best-practices.md:153-176 references/ef-core-best-practices.md:176-180 references/ef-core-best-practices.md:180-188 references/ef-core-best-practices.md:188-194 references/ef-core-best-practices.md:194-228 references/ef-core-best-practices.md:228-232 references/ef-core-best-practices.md:232-253 references/ef-core-best-practices.md:253-259 references/ef-core-best-practices.md:259-280 references/ef-core-best-practices.md:280-286 references/ef-core-best-practices.md:286-295 references/ef-core-best-practices.md:295-299 references/ef-core-best-practices.md:299-315 references/ef-core-best-practices.md:315-319 references/ef-core-best-practices.md:319-329 references/ef-core-best-practices.md:329-333 references/ef-core-best-practices.md:333-355 SKILL.md:25-47 SKILL.md:47-51 SKILL.md:51-101 SKILL.md:101-105 SKILL.md:105-150 SKILL.md:150-154 SKILL.md:154-227 SKILL.md:227-231 SKILL.md:231-293 SKILL.md:293-299 SKILL.md:299-374 SKILL.md:374-378 SKILL.md:378-478 SKILL.md:478-484 SKILL.md:484-597 SKILL.md:597-603 SKILL.md:603-708 SKILL.md:708-712 SKILL.md:712-772 SKILL.md:772-789 SKILL.md:789 SKILL.md:789-794 SKILL.md:794-796 SKILL.md:796-802 SKILL.md:802-803
📁 Filesystem access (2)
Audited by: claude

Jan 4, 2026, 05:09 PM

Pure documentation and code template skill. Contains no executable code, network calls, file system access, or command execution. All content is educational material with example C# patterns for .NET backend development.

7
Files scanned
2,622
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude

Jan 4, 2026, 05:09 PM

Pure documentation and code template skill. Contains no executable code, network calls, file system access, or command execution. All content is educational material with example C# patterns for .NET backend development.

7
Files scanned
2,622
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude