dotnetarium 2.8.1

Dotnetarium

Dotnetarium is an open-source security scanner built for modern C# and .NET. Its taint analysis follows untrusted data through method calls, lambdas and supported framework entry points to the APIs where it can cause trouble. From ASP.NET Core and Razor/Blazor to gRPC, SignalR and message consumers, it helps you understand how a security problem can take shape across your code.

Bring it into your editor with the NuGet analyzer, scan a solution with the command-line tool, or review results in GitHub with the Dotnetarium Action. The same rules and taint engine check for injection, unsafe file access, exposed credentials, risky cryptography and insecure settings, with coverage for the frameworks and libraries .NET developers use today. We're building Dotnetarium to make security review more approachable: useful findings, data-flow paths to investigate, and a quick way to get started without building your application.

Get started

dotnet add MyApp.csproj package Dotnetarium.Analyzers
dotnet tool install --global dotnetarium
dotnetarium MyApp.sln --sarif results.sarif --fail

Update the tool with dotnet tool update --global dotnetarium.

Version 2.x does not support VB.NET, .NET Framework or Visual Studio 2022.

What it checks

Coverage depends on the modeled APIs and available references. See the rule notes and framework guides for supported patterns and limitations.

Scan

The tool accepts .csproj, .sln and .slnx files:

dotnetarium MyApp.csproj --configuration Release --framework net10.0
dotnetarium MyApp.sln -p --sarif project.sarif

For larger repositories, add -v to see which projects are loaded or skipped, per-project timings, and progress updates during analysis:

dotnetarium MyApp.sln -v --sarif results.sarif --fail

Solution scans exclude test projects in both modes. Pass a test .csproj explicitly to scan it. No-build mode needs installed reference packs and existing validated package assets; unresolved code or missing generators reduce coverage. See scan modes and requirements.

Existing CLI scripts should remove -nb / --no-build; those flags are no longer accepted. Add -p to retain project loading.

Local fingerprint decisions live in a separate, unversioned .dotnetarium/suppressions.sarif input file and survive rescans. The --sarif path is regenerated output; use different paths and preserve the input when adding decisions. See local suppressions.

Credential scanning starts at the nearest Git root, including root workflows when the solution is under src/. Outside Git it starts at the project/solution directory. The analyzer checks configuration supplied through AdditionalFiles. Secret values are omitted from output. See credential detection, scope and verification.

Configured depth/work limits are normal and informational. Missing references, compiler errors or unavailable Razor generation produce input warnings while useful analysis continues. SARIF records input quality (available / degraded) separately from analysis limits (within-profile / limited). Neither status guarantees that every vulnerability was found.

Configure

Place lowercase dotnetarium.json beside a project or solution. The analyzer package includes project configuration automatically; the tool discovers it or uses --config. JSON models extend built-in sources, sinks and sanitizers.

The CLI also accepts "ExcludeProjects": ["test/**", "tools/**"] to exclude project analysis while preserving required dependency symbols. Patterns are relative to that configuration file; credential-file scanning keeps its own scope.

{
  "Version": "2.0",
  "AnalysisProfile": "full",
  "ThreatModels": ["remote", "local"]
}

Remote inputs are enabled by default. Add local to check console input, process arguments and environment values.

Profiles change analysis effort, not rules. Cutoffs retain other findings and report configured limits through informational DNA9000. See configuration, numeric overrides and scope and performance comparisons.

Rules are warnings by default. The NuGet analyzer honors .editorconfig; use dotnet_diagnostic.DNAxxxx.severity to change a rule's severity. The CLI applies that policy with --suppress editorconfig or all; --respect-editorconfig remains an alias.

Guides

Run from source with a .NET 10 SDK:

dotnet run --project Dotnetarium.Tool -- MyApp.sln --sarif results.sarif --fail

Moving from 1.x

New features go to 2.x. 1.3.0 remains available for VB.NET and .NET Framework 4.8 on release/1.x.

Replace Dotnetarium.Analyzers.SCS with Dotnetarium.Analyzers, dotnetarium-scs with dotnetarium, and YAML configuration with dotnetarium.json. Update suppressions and SARIF filters for the sequential DNA IDs. Local sources require explicit opt-in.

License

Dotnetarium 2.x uses Apache License 2.0. Bundled Roslyn sources retain their original licenses; see third-party notices.