Security defaults that belong in every ASP.NET Core application from day one.
87
83%
Does it follow best practices?
Impact
94%
1.91xAverage score across 5 eval scenarios
Passed
No known issues
A content team needs a REST API for their blogging platform. The API is built with ASP.NET Core and C#. A Next.js frontend hosted on a separate domain will consume it. The API will eventually run on a cloud VM behind a load balancer.
The API needs the following endpoints:
GET /api/posts -- list all published posts (public, supports ?page=1&pageSize=10&tag=csharp)GET /api/posts/{slug} -- get a single post by its URL slug (public)POST /api/posts -- create a new blog post (authenticated, accepts title, content, tags array, isPublished)PUT /api/posts/{slug} -- update an existing post (authenticated, author only)DELETE /api/posts/{slug} -- delete a post (authenticated, author or admin)POST /api/posts/{slug}/comments -- add a comment to a post (authenticated, accepts body)GET /api/posts/{slug}/comments -- list comments on a post (public)Use an in-memory data store. Posts have Id, Title, Slug, Content, Tags, AuthorId, IsPublished, CreatedAt, UpdatedAt. Comments have Id, PostId, AuthorId, Body, CreatedAt. Generate URL slugs from post titles.
Produce:
Program.cs -- Application setup with all middleware and service registrationControllers/PostsController.cs -- Blog post CRUD endpointsControllers/CommentsController.cs -- Comment endpointsModels/ -- Request DTOs, response DTOs, and entity classesServices/PostService.cs -- Post management business logicappsettings.json -- Configuration fileBlogApi.csproj -- Project file with NuGet packagesevals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
aspnet-security-basics
verifiers