Entity Framework Core 9.0

Apply the C# 12 and .NET 8 baseline first. EF Core 9 targets .NET 8 and can run on .NET 8 or .NET 9; these rules cover servicing release 9.0.19.

Query construction and resource use

• Prefer LINQ and the parameterizing FromSql, FromSqlInterpolated, SqlQuery, and interpolated ExecuteSql APIs. For Cosmos queries in EF9, use FromSql rather than composing request values into FromSqlRaw.
• For relational queries and commands, allow FromSqlRaw, SqlQueryRaw, or ExecuteSqlRaw only behind a narrow adapter whose SQL structure is fixed or selected from an allowlist and whose values are explicit DbParameter instances. Parameterization cannot make an attacker-chosen identifier, ordering token, operator, or provider command safe.
• Never execute text copied from ToQueryString() or diagnostic logs; it is display-oriented SQL and does not preserve the original safe bindings.
• Apply tenant, resource authorization, filtering, ordering, and row limits while the expression is still server-translatable. Calls such as AsEnumerable, AsAsyncEnumerable, or ToList* move later work to the process and can turn a selective query into data exposure or denial of service.
• Bound page size, primitive-collection length, projected columns, includes, retries, and query time. Prefer explicit projections and loading; lazy-loading during serialization, mapping, or logging can issue unreviewed N+1 queries and traverse unauthorized navigations.
• Keep parameterized collections as the default. Use EF.Constant, EF.Parameter, TranslateParameterizedCollectionsToConstants, or