C# 12

Apply these rules whenever you write or review C# 12. Treat nullable annotations, generic constraints, and static types as design controls, not substitutes for validating runtime data at each trust boundary.

Preserve the rules through framework adapters, generated code, serializers, interop layers, and background work.

Compiler and type safety

• Set <Nullable>enable</Nullable> for the whole project and prevent file-level #nullable disable from hiding warnings at request, configuration, serialization, or identity boundaries.
• Pin the compiler warning wave with <WarningLevel>; since the .NET 7 SDK an unset value follows <AnalysisLevel>, which defaults to the target framework and also selects the CA analyzer set.
• Make compiler and CA warnings fail CI with -warnaserror or equivalent MSBuild policy.
• Avoid the null-forgiving operator on request, configuration, lookup, deserialization, and authentication results.
• Model validated identifiers, paths, URLs, and security states as distinct types rather than interchangeable strings.
• Use exhaustive pattern matching for closed security states and reject unknown enum values received at runtime.

Input conversion and validation

• Validate length and syntax before parsing attacker-controlled text into numbers, dates, identifiers, or structured values.
• Use culture-invariant parsing with an exact format for protocol, storage, and security-sensitive values.
• Use TryParse overloads with explicit styles and culture instead of exception-driven or permissive conversion, then check application-specific bounds