csharp-coding

C# Coding

Match the project's existing conventions. When uncertain, read 2-3 existing files to infer the local style. Check .csproj for TargetFramework (net10.0 LTS or net9.0 STS in 2026), C# LangVersion (default latest; assume C# 14 on .NET 10), nullable settings, and analyzer config. These defaults apply only when the project has no established convention.

Never rules

These are unconditional. They prevent bugs and vulnerabilities regardless of project style.

• Never catch { } or catch (Exception) { } without rethrow or logging — catch specific types; at a boundary, log and rethrow or convert to a meaningful error.
• Never throw ex — it resets the stack trace; use throw or wrap: throw new XException("msg", ex).
• Never DateTime.Now — use DateTime.UtcNow or DateTimeOffset.UtcNow. DateTime.Now produces local time that varies by server timezone and breaks across DST transitions. DateTimeOffset is preferred when the timezone context matters.
• Never async void except event handlers — unawaitable, and exceptions crash the process unobserved; use async Task.
• Never .Result, .Wait(), or .GetAwaiter().GetResult() on tasks — these block the calling thread and cause deadlocks in ASP.NET Core and UI contexts. Use await instead. If you're in a sync context that genuinely cannot be made async, use Task.Run(() => AsyncMethod()).GetAwaiter().GetResult() as a last resort with a comment explaining why — the Task.Run hop runs the async work on a thread-pool thread with no SynchronizationContext to marshal back to, which is what sidesteps the deadlock the bare construct causes.
• Never Random for security — use RandomNumberGenerator.GetBytes()/GetInt32() for tokens, keys, and session IDs.
• Never string interpolation or concatenation in SQL — parameterized queries only (@param with SqlCommand.Parameters or the ORM's parameterization).
• Never GC.Collect() — the GC is self-tuning; forcing collection promotes short-lived objects and hurts performance.
• Never mutable static fields — shared across all threads; use DI, IOptions<T>, or ConcurrentDictionary for genuinely shared state.
• Never + string concatenation in loops — use StringBuilder.
• Never dynamic for typed data — it defeats compile-time checking; use generics, interfaces, or pattern matching. Reserve dynamic for COM interop.
• Never Thread.Sleep() in async code — use await Task.Delay(); sleeping blocks a thread-pool thread.