C# 14

Apply these rules to C# 14, including framework adapters, generated code, serializers, interop layers, and background work. Nullable annotations, generic constraints, and static types are design controls, not substitutes for validating runtime data at each trust boundary.

Compiler and type safety

• Set <Nullable>enable</Nullable> project-wide, and don't let file-level #nullable disable hide warnings at request, configuration, serialization, or identity boundaries.
• Pin the warning wave with <WarningLevel>; since the .NET 7 SDK its default follows <AnalysisLevel>, which defaults to the target framework and selects both warning waves and the CA analyzer set. Fail CI on compiler and CA warnings with -warnaserror or equivalent MSBuild policy.
• Turn on security analyzers with <AnalysisModeSecurity>All</AnalysisModeSecurity>: no Security-category CA rule warns by default in .NET 10, including CA2100, CA2300, CA2326, CA3003, CA3006, CA3075, CA5350, CA5359, and CA5394, so -warnaserror alone enforces none. A compound <AnalysisLevel> such as latest-recommended silently overrides AnalysisModeSecurity, so then set <AnalysisLevelSecurity> to that version with -all, such as 10-all or latest-all. Suppress a finding only at the reviewed call site with a written reason, never by lowering the category.
• Avoid the null-forgiving operator on request, configuration, lookup, deserialization, and authentication results.
• Model validated identifiers, paths, URLs, and security states as distinct types, not interchangeable strings, and match closed security