attackmap-analyzer-dotnet 0.1.0__tar.gz

attackmap_analyzer_dotnet-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matthew Davis and AttackMap Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

attackmap_analyzer_dotnet-0.1.0/PKG-INFO

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-dotnet
+Version: 0.1.0
+Summary: C# / .NET (ASP.NET Core) ecosystem analyzer plugin for AttackMap (minimal APIs, attribute routing, EF Core, Identity, JwtBearer).
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-dotnet
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-dotnet
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-dotnet/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-dotnet/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.1.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.1.0; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-dotnet
+
+C# / .NET (ASP.NET Core) ecosystem analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+This analyzer extracts structured signals from .NET solutions and projects:
+
+- **Web frameworks** — ASP.NET Core minimal APIs (`app.MapGet`, `app.MapPost`, `app.MapMethods`), attribute routing on controllers (`[HttpGet]`, `[HttpPost]`, with class-level `[Route]` prefix joining and `[controller]` token substitution)
+- **Databases** — Entity Framework Core (`UseSqlServer` / `UseNpgsql` / `UseMySql` / `UseSqlite`), Dapper, System.Data.SqlClient / Microsoft.Data.SqlClient, Npgsql, MySql.Data / MySqlConnector, MongoDB.Driver, StackExchange.Redis, AWS SDK (S3, DynamoDB)
+- **Auth packages** — `AddJwtBearer` (Microsoft.AspNetCore.Authentication.JwtBearer), `AddOpenIdConnect`, ASP.NET Identity (`UserManager`, `SignInManager`, `IdentityUser`, `PasswordHasher`), `[Authorize]` attribute, Duende IdentityServer, BCrypt.Net, Argon2
+- **HTTP clients (external calls)** — `HttpClient.GetAsync` / `PostAsync` / `SendAsync`, `HttpRequestMessage`, `RestClient` (RestSharp), `new Uri(...)`
+- **Secrets** — `Environment.GetEnvironmentVariable("...")`, `IConfiguration["..."]` / `Configuration["..."]` / `builder.Configuration["..."]` with secret-shaped keys, `GetConnectionString(...)`
+- **Service hints** — `<RootNamespace>` and `<AssemblyName>` from `.csproj`
+
+All emissions populate AttackMap's Signal v2 fields (line numbers, evidence snippets, confidence scores) so downstream insights can cite `path/to/file.cs:NN`.
+
+## Install
+
+```bash
+pip install git+https://github.com/mlaify/attackmap-analyzer-dotnet.git
+```
+
+The analyzer is auto-discovered by AttackMap via the `attackmap.analyzers` entry-point group.
+
+## Usage with AttackMap
+
+```bash
+# Auto-discovered when installed:
+attackmap analyze /path/to/dotnet/repo
+
+# Or invoke explicitly:
+attackmap analyze /path/to/dotnet/repo --module dotnet
+```
+
+## Detection
+
+`detect()` returns true when any of the following are present, ignoring `bin/`, `obj/`, `.vs/`, `.idea/`, `.git/`, `node_modules/`, `packages/`, `TestResults/`, and `publish/`:
+
+- A `.csproj`, `.fsproj`, or `.sln` file anywhere in the tree
+- A `.cs` file anywhere in the tree
+
+## Coverage notes
+
+- **Class-level `[Route]` prefix joining**: a controller annotated with `[Route("api/[controller]")]` or `[Route("api/orders")]` causes its method-level `[HttpGet("{id:int}")]` to emit as `api/Orders/{id:int}` (with `[controller]` substituted with the class name minus the `Controller` suffix). Multiple controllers per file are tracked correctly.
+- **Minimal API + controller routing in the same project**: both extractors run on every `.cs` file. The minimal-API regex looks for `app.Map*("...", handler)`; the controller regex looks for `[HttpX("...")]` attributes. They don't overlap.
+- **Connection strings as secrets**: `GetConnectionString("DefaultConnection")` is treated as a secret reference because the connection string itself is a credential. The named key (`DefaultConnection`) is stored as the secret name.
+- **F# (.fs) projects** are detected via `.fsproj` but route extraction is not yet implemented (Giraffe / Saturn).
+- **Razor Pages** (`@page` directives in `.cshtml` / `.razor`) are not yet covered. Most security-critical APIs use minimal APIs or controllers.
+
+## License
+
+MIT

attackmap_analyzer_dotnet-0.1.0/README.md

@@ -0,0 +1,51 @@
+# attackmap-analyzer-dotnet
+
+C# / .NET (ASP.NET Core) ecosystem analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+This analyzer extracts structured signals from .NET solutions and projects:
+
+- **Web frameworks** — ASP.NET Core minimal APIs (`app.MapGet`, `app.MapPost`, `app.MapMethods`), attribute routing on controllers (`[HttpGet]`, `[HttpPost]`, with class-level `[Route]` prefix joining and `[controller]` token substitution)
+- **Databases** — Entity Framework Core (`UseSqlServer` / `UseNpgsql` / `UseMySql` / `UseSqlite`), Dapper, System.Data.SqlClient / Microsoft.Data.SqlClient, Npgsql, MySql.Data / MySqlConnector, MongoDB.Driver, StackExchange.Redis, AWS SDK (S3, DynamoDB)
+- **Auth packages** — `AddJwtBearer` (Microsoft.AspNetCore.Authentication.JwtBearer), `AddOpenIdConnect`, ASP.NET Identity (`UserManager`, `SignInManager`, `IdentityUser`, `PasswordHasher`), `[Authorize]` attribute, Duende IdentityServer, BCrypt.Net, Argon2
+- **HTTP clients (external calls)** — `HttpClient.GetAsync` / `PostAsync` / `SendAsync`, `HttpRequestMessage`, `RestClient` (RestSharp), `new Uri(...)`
+- **Secrets** — `Environment.GetEnvironmentVariable("...")`, `IConfiguration["..."]` / `Configuration["..."]` / `builder.Configuration["..."]` with secret-shaped keys, `GetConnectionString(...)`
+- **Service hints** — `<RootNamespace>` and `<AssemblyName>` from `.csproj`
+
+All emissions populate AttackMap's Signal v2 fields (line numbers, evidence snippets, confidence scores) so downstream insights can cite `path/to/file.cs:NN`.
+
+## Install
+
+```bash
+pip install git+https://github.com/mlaify/attackmap-analyzer-dotnet.git
+```
+
+The analyzer is auto-discovered by AttackMap via the `attackmap.analyzers` entry-point group.
+
+## Usage with AttackMap
+
+```bash
+# Auto-discovered when installed:
+attackmap analyze /path/to/dotnet/repo
+
+# Or invoke explicitly:
+attackmap analyze /path/to/dotnet/repo --module dotnet
+```
+
+## Detection
+
+`detect()` returns true when any of the following are present, ignoring `bin/`, `obj/`, `.vs/`, `.idea/`, `.git/`, `node_modules/`, `packages/`, `TestResults/`, and `publish/`:
+
+- A `.csproj`, `.fsproj`, or `.sln` file anywhere in the tree
+- A `.cs` file anywhere in the tree
+
+## Coverage notes
+
+- **Class-level `[Route]` prefix joining**: a controller annotated with `[Route("api/[controller]")]` or `[Route("api/orders")]` causes its method-level `[HttpGet("{id:int}")]` to emit as `api/Orders/{id:int}` (with `[controller]` substituted with the class name minus the `Controller` suffix). Multiple controllers per file are tracked correctly.
+- **Minimal API + controller routing in the same project**: both extractors run on every `.cs` file. The minimal-API regex looks for `app.Map*("...", handler)`; the controller regex looks for `[HttpX("...")]` attributes. They don't overlap.
+- **Connection strings as secrets**: `GetConnectionString("DefaultConnection")` is treated as a secret reference because the connection string itself is a credential. The named key (`DefaultConnection`) is stored as the secret name.
+- **F# (.fs) projects** are detected via `.fsproj` but route extraction is not yet implemented (Giraffe / Saturn).
+- **Razor Pages** (`@page` directives in `.cshtml` / `.razor`) are not yet covered. Most security-critical APIs use minimal APIs or controllers.
+
+## License
+
+MIT

attackmap_analyzer_dotnet-0.1.0/pyproject.toml

@@ -0,0 +1,74 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "attackmap-analyzer-dotnet"
+version = "0.1.0"
+description = "C# / .NET (ASP.NET Core) ecosystem analyzer plugin for AttackMap (minimal APIs, attribute routing, EF Core, Identity, JwtBearer)."
+readme = "README.md"
+requires-python = ">=3.11"
+license = {text = "MIT"}
+authors = [
+  {name = "Matthew Davis", email = "matthewd@matthewd.xyz"},
+  {name = "AttackMap Contributors"},
+]
+maintainers = [
+  {name = "Matthew Davis", email = "matthewd@matthewd.xyz"},
+]
+keywords = [
+  "security",
+  "static-analysis",
+  "appsec",
+  "defensive-security",
+  "attackmap",
+  "attackmap-plugin",
+]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Intended Audience :: Developers",
+  "Intended Audience :: Information Technology",
+  "Intended Audience :: System Administrators",
+  "License :: OSI Approved :: MIT License",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3 :: Only",
+  "Topic :: Security",
+  "Topic :: Software Development :: Quality Assurance",
+  "Typing :: Typed",
+]
+dependencies = [
+  "pydantic>=2.7.0",
+]
+
+[project.optional-dependencies]
+core = [
+  "attackmap>=0.1.0",
+]
+dev = [
+  "pytest>=8.0.0",
+  "build>=1.2.0",
+  "attackmap>=0.1.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/mlaify/attackmap-analyzer-dotnet"
+Repository = "https://github.com/mlaify/attackmap-analyzer-dotnet"
+Issues = "https://github.com/mlaify/attackmap-analyzer-dotnet/issues"
+Changelog = "https://github.com/mlaify/attackmap-analyzer-dotnet/blob/main/CHANGELOG.md"
+"AttackMap core" = "https://github.com/mlaify/AttackMap"
+
+[project.entry-points."attackmap.analyzers"]
+dotnet = "attackmap_analyzer_dotnet:DotnetAnalyzer"
+
+[tool.setuptools]
+package-dir = {"" = "src"}
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

attackmap_analyzer_dotnet-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

attackmap_analyzer_dotnet-0.1.0/src/attackmap_analyzer_dotnet/__init__.py

@@ -0,0 +1,3 @@
+from .analyzer import DotnetAnalyzer
+
+__all__ = ["DotnetAnalyzer"]

attackmap_analyzer_dotnet-0.1.0/src/attackmap_analyzer_dotnet/analyzer.py

@@ -0,0 +1,501 @@
+"""C# / .NET ASP.NET Core ecosystem analyzer for AttackMap.
+
+Coverage (v0.1):
+- Web frameworks: ASP.NET Core minimal APIs (`app.MapGet`, `app.MapPost`, ...),
+  ASP.NET Core attribute routing (`[HttpGet]`, `[HttpPost]`, with class-level
+  `[Route]` prefix joining and `[controller]` token substitution)
+- Databases: Entity Framework Core (DbContext + UseSqlServer/UseNpgsql/UseSqlite/
+  UseMySql), Dapper, System.Data.SqlClient / Microsoft.Data.SqlClient (SQL Server),
+  Npgsql (Postgres), MySql.Data / MySqlConnector, MongoDB.Driver, StackExchange.Redis,
+  AWS SDK (S3, DynamoDB)
+- Auth: Microsoft.AspNetCore.Authentication.JwtBearer (AddJwtBearer), Identity
+  (UserManager, SignInManager, IdentityUser, PasswordHasher), `[Authorize]` attribute,
+  AddOpenIdConnect, Duende IdentityServer
+- HTTP clients (external calls): HttpClient (GetAsync/PostAsync/SendAsync), RestSharp
+- Secrets: Environment.GetEnvironmentVariable, IConfiguration["..."] / Configuration
+  bindings with secret-shaped keys
+- Entrypoints: WebApplication.CreateBuilder + .Run(), Host.CreateDefaultBuilder
+- Service hints: <RootNamespace> / <AssemblyName> from .csproj
+
+Class-level [Route("api/[controller]")] is parsed and the `[controller]` token
+is substituted with the controller class name (minus the "Controller" suffix)
+to produce the final route path.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from .contracts import (
+    AnalyzerMetadata,
+    AuthHint,
+    DatabaseHint,
+    EntrypointHint,
+    ExternalCall,
+    FrameworkHint,
+    Route,
+    ScanResult,
+    SecretHint,
+    ServiceHint,
+)
+
+CODE_SUFFIXES = {".cs"}
+CONFIG_FILES = {"appsettings.json", "appsettings.Development.json"}
+PROJECT_FILES = {".csproj", ".fsproj", ".sln"}
+SKIP_DIRS = {
+    "bin",
+    "obj",
+    ".vs",
+    ".idea",
+    ".git",
+    "node_modules",
+    "packages",
+    "TestResults",
+    "publish",
+}
+_SNIPPET_MAX_CHARS = 160
+
+
+# ---------- Patterns ----------
+
+# Minimal APIs: app.MapGet("/x", handler), app.MapPost(...), etc.
+MINIMAL_API_PATTERN = re.compile(
+    r'\b\w+\.Map(Get|Post|Put|Delete|Patch|Head|Options)\s*\(\s*"([^"]+)"',
+)
+# app.MapMethods("/x", new[] { "GET", "POST" }, handler)
+MINIMAL_API_METHODS_PATTERN = re.compile(
+    r'\b\w+\.MapMethods\s*\(\s*"([^"]+)"\s*,\s*new\[\]\s*\{\s*([^}]+)\s*\}',
+)
+
+# Attribute routing on controllers
+HTTP_ATTRIBUTE_PATTERN = re.compile(
+    r'\[\s*Http(Get|Post|Put|Delete|Patch|Head|Options)\s*(?:\(\s*"([^"]*)"\s*\))?\s*\]',
+)
+# Class-level [Route("api/[controller]")] or [Route("api/users")]
+# `[^\{]*?` allows other attributes ([ApiController], [Authorize], etc.) between
+# the [Route] and the class declaration, but not a class body start `{`.
+CLASS_ROUTE_ATTRIBUTE_PATTERN = re.compile(
+    r'\[\s*Route\s*\(\s*"([^"]+)"\s*\)\s*\][^\{]*?\bclass\s+(\w+)',
+    re.DOTALL,
+)
+# Method-level [Route("/x")] (less common, but valid)
+METHOD_ROUTE_ATTRIBUTE_PATTERN = re.compile(
+    r'\[\s*Route\s*\(\s*"([^"]+)"\s*\)\s*\]',
+)
+
+# External HTTP calls. The receiver-name regex is intentionally permissive (any
+# identifier can be a HttpClient field, often `_httpClient`); we anchor on the
+# call shape (.GetAsync/.PostAsync/...) and require an http(s) URL literal.
+OUTBOUND_PATTERNS: list[re.Pattern[str]] = [
+    re.compile(r'\.(?:Get|Post|Put|Delete|Patch|Send)(?:Async|Json|String)?(?:Async)?\s*\(\s*"(https?://[^"]+)"', re.IGNORECASE),
+    re.compile(r'\bnew\s+HttpRequestMessage\s*\(\s*HttpMethod\.\w+\s*,\s*"(https?://[^"]+)"'),
+    re.compile(r'\bnew\s+RestClient\s*\(\s*"(https?://[^"]+)"'),
+    re.compile(r'\bnew\s+Uri\s*\(\s*"(https?://[^"]+)"'),
+]
+
+# Database libs
+DB_PATTERNS: list[tuple[re.Pattern[str], str]] = [
+    (re.compile(r'\.UseSqlServer\s*\('), "sqlserver"),
+    (re.compile(r'\.UseNpgsql\s*\(|\bNpgsql\b'), "postgresql"),
+    (re.compile(r'\.UseMySql\s*\(|\bMySqlConnector\b|\bMySql\.Data\b'), "mysql"),
+    (re.compile(r'\.UseSqlite\s*\(|\bMicrosoft\.Data\.Sqlite\b'), "sqlite"),
+    (re.compile(r'\.UseInMemoryDatabase\s*\('), "in_memory"),
+    (re.compile(r'\bDbContext\b|\bDbSet<'), "sql"),
+    (re.compile(r'\busing\s+Dapper\b|\bIDbConnection\b'), "sql"),
+    (re.compile(r'\bSqlConnection\s*\('), "sqlserver"),
+    (re.compile(r'\bMongoClient\s*\(|\bIMongoDatabase\b|\bMongoDB\.Driver\b'), "mongodb"),
+    (re.compile(r'\bConnectionMultiplexer\.Connect\s*\(|\bStackExchange\.Redis\b'), "redis"),
+    (re.compile(r'\bAmazonS3Client\b|\bAWSSDK\.S3\b'), "object_storage"),
+    (re.compile(r'\bAmazonDynamoDBClient\b|\bAWSSDK\.DynamoDBv2\b'), "dynamodb"),
+]
+
+# Auth-related signals
+AUTH_PATTERNS: list[tuple[re.Pattern[str], str, float]] = [
+    (re.compile(r'\.AddJwtBearer\s*\(|\bMicrosoft\.AspNetCore\.Authentication\.JwtBearer\b'), "jwt", 0.85),
+    (re.compile(r'\.AddOpenIdConnect\s*\(|\bOpenIdConnect\b'), "oidc", 0.85),
+    (re.compile(r'\.AddOAuth\s*\(|\bOAuth\b', re.IGNORECASE), "oauth", 0.85),
+    (re.compile(r'\bUserManager<|\bSignInManager<|\bIdentityUser\b'), "aspnet_identity", 0.85),
+    (re.compile(r'\bPasswordHasher<|\bIPasswordHasher\b'), "password_hasher", 0.85),
+    (re.compile(r'\bBCrypt\.Net\b|\bBCryptPasswordHasher\b'), "bcrypt", 0.9),
+    (re.compile(r'\bArgon2\b'), "argon2", 0.9),
+    (re.compile(r'\[\s*Authorize\b'), "authorize_attribute", 0.85),
+    (re.compile(r'\.AddAuthorization\s*\('), "authorization_setup", 0.85),
+    (re.compile(r'\bDuende\.IdentityServer\b|\bIdentityServer4\b'), "identityserver", 0.85),
+    (re.compile(r'\bAuthorization\b'), "authorization_header", 0.6),
+    (re.compile(r'\bBearer\b'), "bearer_token", 0.6),
+    (re.compile(r'\bapi[_-]?key\b', re.IGNORECASE), "api_key", 0.6),
+]
+
+FRAMEWORK_PATTERNS: list[tuple[re.Pattern[str], str]] = [
+    (re.compile(r'\bMicrosoft\.AspNetCore\.Builder\b|\bWebApplication\.CreateBuilder\b'), "aspnetcore"),
+    (re.compile(r'\bMicrosoft\.AspNetCore\.Mvc\b|\[ApiController\]|\[Controller\]'), "aspnetcore-mvc"),
+    (re.compile(r'\bMicrosoft\.AspNetCore\.Mvc\.RazorPages\b'), "aspnetcore-razor"),
+    (re.compile(r'\bMicrosoft\.EntityFrameworkCore\b'), "efcore"),
+    (re.compile(r'\bMicrosoft\.AspNetCore\.SignalR\b'), "signalr"),
+    (re.compile(r'\bMicrosoft\.AspNetCore\.Authentication\b'), "aspnetcore-auth"),
+    (re.compile(r'\bMicrosoft\.AspNetCore\.Identity\b'), "aspnetcore-identity"),
+    (re.compile(r'\bGrpc\.Net\.Client\b|\bGrpc\.AspNetCore\b'), "grpc"),
+]
+
+ENTRYPOINT_PATTERNS: list[tuple[re.Pattern[str], str]] = [
+    (re.compile(r'\bWebApplication\.CreateBuilder\s*\(|\bWebApplicationBuilder\b'), "webapplication_builder"),
+    (re.compile(r'\bapp\.Run\s*\(\s*\)'), "webapp_run"),
+    (re.compile(r'\bHost\.CreateDefaultBuilder\s*\('), "generic_host"),
+    (re.compile(r'\bUseStartup<'), "use_startup"),
+]
+
+# Secrets — env vars + IConfiguration accesses with secret-shaped keys
+SECRET_PATTERNS: list[re.Pattern[str]] = [
+    re.compile(
+        r'\bEnvironment\.GetEnvironmentVariable\s*\(\s*"([A-Z0-9_]*(?:SECRET|TOKEN|KEY|PASSWORD|PASS|PWD)[A-Z0-9_]*)"',
+    ),
+    # IConfiguration indexer access — receiver name varies (cfg, _cfg, configuration,
+    # builder.Configuration, etc.); we anchor on the secret-shaped key inside the brackets.
+    re.compile(
+        r'\b\w+(?:\.\w+)?\s*\[\s*"([A-Za-z0-9_:.]*(?:secret|token|key|password|pass|pwd)[A-Za-z0-9_:.]*)"',
+        re.IGNORECASE,
+    ),
+    re.compile(
+        r'\bGetConnectionString\s*\(\s*"([^"]+)"',
+    ),
+]
+
+
+def _line_of(content: str, offset: int) -> int:
+    if offset <= 0:
+        return 1
+    return content.count("\n", 0, offset) + 1
+
+
+def _line_snippet(content: str, offset: int, *, max_chars: int = _SNIPPET_MAX_CHARS) -> str:
+    line_start = content.rfind("\n", 0, offset) + 1
+    line_end = content.find("\n", offset)
+    if line_end == -1:
+        line_end = len(content)
+    line = content[line_start:line_end].strip()
+    if len(line) > max_chars:
+        line = line[: max_chars - 1] + "…"
+    return line
+
+
+def _join_paths(prefix: str, suffix: str) -> str:
+    p = prefix.strip()
+    s = suffix.strip()
+    if not p:
+        return s or "/"
+    if not s:
+        return p or "/"
+    if p == "/":
+        return s if s.startswith("/") else "/" + s
+    if s == "/":
+        return p
+    return p.rstrip("/") + "/" + s.lstrip("/")
+
+
+def _substitute_controller_token(route_template: str, controller_name: str) -> str:
+    """Replace [controller] in route template with controller class name minus 'Controller'."""
+    name = controller_name
+    if name.endswith("Controller"):
+        name = name[: -len("Controller")]
+    return route_template.replace("[controller]", name).replace("[Controller]", name)
+
+
+def _class_routes_in_file(content: str) -> list[tuple[int, str, str]]:
+    """Return [(start_offset, route_template_after_substitution, controller_class), ...]
+    for every class-level [Route(...)] annotation in the file.
+    """
+    results: list[tuple[int, str, str]] = []
+    for match in CLASS_ROUTE_ATTRIBUTE_PATTERN.finditer(content):
+        template, class_name = match.group(1), match.group(2)
+        substituted = _substitute_controller_token(template, class_name)
+        results.append((match.start(), substituted, class_name))
+    return results
+
+
+def _active_class_route(prefixes: list[tuple[int, str, str]], offset: int) -> str:
+    """The most recent class-level [Route] preceding the offset, post-substitution."""
+    active = ""
+    for start, template, _ in prefixes:
+        if start < offset:
+            active = template
+        else:
+            break
+    return active
+
+
+def _extract_csproj_meta(csproj_path: Path) -> tuple[str | None, str | None]:
+    """Return (root_namespace, assembly_name) from a .csproj file."""
+    try:
+        text = csproj_path.read_text(encoding="utf-8")
+    except UnicodeDecodeError:
+        return None, None
+    rn = re.search(r"<RootNamespace>([^<]+)</RootNamespace>", text)
+    an = re.search(r"<AssemblyName>([^<]+)</AssemblyName>", text)
+    return (rn.group(1).strip() if rn else None, an.group(1).strip() if an else None)
+
+
+class DotnetAnalyzer:
+    metadata = AnalyzerMetadata(
+        name="dotnet",
+        display_name="C# / .NET Analyzer",
+        version="0.1.0",
+        description="ASP.NET Core analyzer covering minimal APIs, attribute routing, EF Core, Identity, and JwtBearer.",
+        scope=".NET solutions and projects (.csproj, .sln). Detects ASP.NET Core minimal APIs and controllers.",
+        targets=["dotnet", "csharp", "aspnetcore"],
+        languages=["csharp"],
+        priority=20,
+        experimental=False,
+        enabled_by_default=True,
+    )
+
+    @property
+    def name(self) -> str:
+        return self.metadata.name
+
+    # ---------- Public entry points ----------
+
+    def detect(self, repo_path: str | Path) -> bool:
+        root = Path(repo_path).resolve()
+        if not root.exists() or not root.is_dir():
+            return False
+        # Project / solution markers
+        for path in root.rglob("*"):
+            if any(part in SKIP_DIRS for part in path.parts):
+                continue
+            if not path.is_file():
+                continue
+            if path.suffix in {".csproj", ".sln", ".fsproj"}:
+                return True
+            if path.suffix in CODE_SUFFIXES:
+                return True
+        return False
+
+    def analyze(self, repo_path: str | Path) -> ScanResult:
+        root = Path(repo_path).resolve()
+        result = ScanResult(root=str(root))
+        if not root.exists() or not root.is_dir():
+            return result
+
+        # Service-name hints from .csproj files
+        for csproj in root.rglob("*.csproj"):
+            if any(part in SKIP_DIRS for part in csproj.parts):
+                continue
+            root_ns, assembly = _extract_csproj_meta(csproj)
+            relative = str(csproj.relative_to(root))
+            if root_ns:
+                self._append_unique_service(result, f"namespace:{root_ns}", relative)
+            if assembly:
+                self._append_unique_service(result, f"assembly:{assembly}", relative)
+
+        for file_path in root.rglob("*"):
+            if not file_path.is_file():
+                continue
+            if any(part in SKIP_DIRS for part in file_path.parts):
+                continue
+            if file_path.suffix not in CODE_SUFFIXES:
+                continue
+
+            result.files_scanned += 1
+            if "csharp" not in result.languages:
+                result.languages.append("csharp")
+
+            try:
+                content = file_path.read_text(encoding="utf-8")
+            except UnicodeDecodeError:
+                continue
+
+            relative = str(file_path.relative_to(root))
+            self._extract_routes(content, relative, result)
+            self._extract_databases(content, relative, result)
+            self._extract_auth(content, relative, result)
+            self._extract_secrets(content, relative, result)
+            self._extract_external_calls(content, relative, result)
+            self._extract_frameworks(content, relative, result)
+            self._extract_entrypoints(content, relative, result)
+            self._infer_service_role(content, relative, result)
+
+        result.languages.sort()
+        return result
+
+    # ---------- Extractors ----------
+
+    def _extract_routes(self, content: str, relative: str, result: ScanResult) -> None:
+        # Minimal APIs: app.MapGet("/x", handler), etc.
+        for match in MINIMAL_API_PATTERN.finditer(content):
+            method, path = match.group(1).upper(), match.group(2)
+            self._append_unique_route(result, path, method, relative, _line_of(content, match.start()))
+
+        # Minimal APIs: app.MapMethods("/x", new[] { "GET", "POST" }, handler)
+        for match in MINIMAL_API_METHODS_PATTERN.finditer(content):
+            path = match.group(1)
+            verbs_raw = match.group(2)
+            verbs = re.findall(r'"([A-Za-z]+)"', verbs_raw)
+            line = _line_of(content, match.start())
+            for verb in verbs:
+                self._append_unique_route(result, path, verb.upper(), relative, line)
+
+        # Attribute routing: class-level [Route("api/[controller]")] + method-level [HttpGet]
+        class_routes = _class_routes_in_file(content)
+        for match in HTTP_ATTRIBUTE_PATTERN.finditer(content):
+            method = match.group(1).upper()
+            method_path = match.group(2) or ""
+            prefix = _active_class_route(class_routes, match.start())
+            full_path = _join_paths(prefix, method_path) if prefix else (method_path or "/")
+            self._append_unique_route(result, full_path, method, relative, _line_of(content, match.start()))
+
+        # Method-level [Route("/x")] — emit with method ANY (rare but legal)
+        for match in METHOD_ROUTE_ATTRIBUTE_PATTERN.finditer(content):
+            # Skip class-level routes — those are handled as prefixes above.
+            if any(start == match.start() for start, _, _ in class_routes):
+                continue
+            method_path = match.group(1)
+            prefix = _active_class_route(class_routes, match.start())
+            # Skip if the [HttpX(...)] attribute regex already would have matched this
+            # (i.e. the regex is part of an [HttpGet("/x")] form). We detect that by
+            # checking whether this offset's match overlaps with any HTTP_ATTRIBUTE_PATTERN
+            # match — but cheaper: Routes inside [Http*] aren't matched by METHOD_ROUTE_ATTRIBUTE
+            # because the latter requires "[Route(" specifically.
+            full_path = _join_paths(prefix, method_path) if prefix else (method_path or "/")
+            self._append_unique_route(result, full_path, "ANY", relative, _line_of(content, match.start()))
+
+    def _extract_databases(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, kind in DB_PATTERNS:
+            match = pattern.search(content)
+            if match is None:
+                continue
+            self._append_unique_database(
+                result, kind, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+            )
+
+    def _extract_auth(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, hint, confidence in AUTH_PATTERNS:
+            match = pattern.search(content)
+            if match is None:
+                continue
+            self._append_unique_auth(
+                result, hint, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+                confidence,
+            )
+
+    def _extract_secrets(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern in SECRET_PATTERNS:
+            for match in pattern.finditer(content):
+                groups = match.groups()
+                name = groups[0] if groups and groups[0] else "unknown"
+                self._append_unique_secret(
+                    result, name, relative,
+                    _line_of(content, match.start()),
+                    _line_snippet(content, match.start()),
+                )
+
+    def _extract_external_calls(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern in OUTBOUND_PATTERNS:
+            for match in pattern.finditer(content):
+                target = match.group(1)
+                if not (target.startswith("http://") or target.startswith("https://")):
+                    continue
+                self._append_unique_external(
+                    result, target, relative,
+                    _line_of(content, match.start()),
+                    _line_snippet(content, match.start()),
+                )
+
+    def _extract_frameworks(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, name in FRAMEWORK_PATTERNS:
+            match = pattern.search(content)
+            if match is None:
+                continue
+            self._append_unique_framework(
+                result, name, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+            )
+
+    def _extract_entrypoints(self, content: str, relative: str, result: ScanResult) -> None:
+        for pattern, hint in ENTRYPOINT_PATTERNS:
+            match = pattern.search(content)
+            if match is None:
+                continue
+            self._append_unique_entrypoint(
+                result, hint, relative,
+                _line_of(content, match.start()),
+                _line_snippet(content, match.start()),
+            )
+
+    def _infer_service_role(self, content: str, relative: str, result: ScanResult) -> None:
+        haystack = (relative + " " + content[:500]).lower()
+        role: str | None = None
+        if any(token in haystack for token in ("worker", "consumer", "queue", "background", "hostedservice")):
+            role = "worker"
+        elif any(token in haystack for token in ("controller", "api", "endpoint", "router")):
+            role = "api"
+        elif any(token in haystack for token in ("client", "sdk")):
+            role = "client"
+        if role:
+            self._append_unique_service(result, f"service_role:{role}", relative)
+
+    # ---------- Append helpers ----------
+
+    @staticmethod
+    def _append_unique_route(result: ScanResult, path: str, method: str, file: str, line: int | None) -> None:
+        key = (path, method, file)
+        if any((item.path, item.method, item.file) == key for item in result.routes):
+            return
+        result.routes.append(Route(path=path, method=method, file=file, line=line))
+
+    @staticmethod
+    def _append_unique_database(result: ScanResult, kind: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (kind, file)
+        if any((item.kind, item.file) == key for item in result.databases):
+            return
+        result.databases.append(DatabaseHint(kind=kind, file=file, line=line, evidence_text=evidence))
+
+    @staticmethod
+    def _append_unique_auth(result: ScanResult, hint: str, file: str, line: int | None, evidence: str | None, confidence: float) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.auth_hints):
+            return
+        result.auth_hints.append(AuthHint(hint=hint, file=file, line=line, evidence_text=evidence, confidence=confidence))
+
+    @staticmethod
+    def _append_unique_secret(result: ScanResult, name: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (name, file)
+        if any((item.name, item.file) == key for item in result.secret_hints):
+            return
+        result.secret_hints.append(SecretHint(name=name, file=file, line=line, evidence_text=evidence, confidence=0.85))
+
+    @staticmethod
+    def _append_unique_external(result: ScanResult, target: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (target, file)
+        if any((item.target, item.file) == key for item in result.external_calls):
+            return
+        result.external_calls.append(ExternalCall(target=target, file=file, line=line, evidence_text=evidence))
+
+    @staticmethod
+    def _append_unique_framework(result: ScanResult, hint: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.framework_hints):
+            return
+        result.framework_hints.append(FrameworkHint(hint=hint, file=file, line=line, evidence_text=evidence))
+
+    @staticmethod
+    def _append_unique_entrypoint(result: ScanResult, hint: str, file: str, line: int | None, evidence: str | None) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.entrypoint_hints):
+            return
+        result.entrypoint_hints.append(EntrypointHint(hint=hint, file=file, line=line, evidence_text=evidence))
+
+    @staticmethod
+    def _append_unique_service(result: ScanResult, hint: str, file: str) -> None:
+        key = (hint, file)
+        if any((item.hint, item.file) == key for item in result.service_hints):
+            return
+        result.service_hints.append(ServiceHint(hint=hint, file=file))
+
+
+__all__ = ["DotnetAnalyzer"]

attackmap_analyzer_dotnet-0.1.0/src/attackmap_analyzer_dotnet/contracts.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+from attackmap.sdk.contracts import AnalyzerMetadata, AnalyzerProtocol
+from attackmap.sdk.models import (
+    AuthHint,
+    DatabaseHint,
+    EntrypointHint,
+    ExternalCall,
+    FrameworkHint,
+    Route,
+    ScanResult,
+    SecretHint,
+    ServiceHint,
+)
+
+AttackMapAnalyzerProtocol = AnalyzerProtocol
+
+__all__ = [
+    "AnalyzerMetadata",
+    "AttackMapAnalyzerProtocol",
+    "Route",
+    "ExternalCall",
+    "DatabaseHint",
+    "AuthHint",
+    "EntrypointHint",
+    "FrameworkHint",
+    "ServiceHint",
+    "SecretHint",
+    "ScanResult",
+]

attackmap_analyzer_dotnet-0.1.0/src/attackmap_analyzer_dotnet.egg-info/PKG-INFO

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: attackmap-analyzer-dotnet
+Version: 0.1.0
+Summary: C# / .NET (ASP.NET Core) ecosystem analyzer plugin for AttackMap (minimal APIs, attribute routing, EF Core, Identity, JwtBearer).
+Author: AttackMap Contributors
+Author-email: Matthew Davis <matthewd@matthewd.xyz>
+Maintainer-email: Matthew Davis <matthewd@matthewd.xyz>
+License: MIT
+Project-URL: Homepage, https://github.com/mlaify/attackmap-analyzer-dotnet
+Project-URL: Repository, https://github.com/mlaify/attackmap-analyzer-dotnet
+Project-URL: Issues, https://github.com/mlaify/attackmap-analyzer-dotnet/issues
+Project-URL: Changelog, https://github.com/mlaify/attackmap-analyzer-dotnet/blob/main/CHANGELOG.md
+Project-URL: AttackMap core, https://github.com/mlaify/AttackMap
+Keywords: security,static-analysis,appsec,defensive-security,attackmap,attackmap-plugin
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.7.0
+Provides-Extra: core
+Requires-Dist: attackmap>=0.1.0; extra == "core"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0.0; extra == "dev"
+Requires-Dist: build>=1.2.0; extra == "dev"
+Requires-Dist: attackmap>=0.1.0; extra == "dev"
+Dynamic: license-file
+
+# attackmap-analyzer-dotnet
+
+C# / .NET (ASP.NET Core) ecosystem analyzer for [AttackMap](https://github.com/mlaify/AttackMap).
+
+This analyzer extracts structured signals from .NET solutions and projects:
+
+- **Web frameworks** — ASP.NET Core minimal APIs (`app.MapGet`, `app.MapPost`, `app.MapMethods`), attribute routing on controllers (`[HttpGet]`, `[HttpPost]`, with class-level `[Route]` prefix joining and `[controller]` token substitution)
+- **Databases** — Entity Framework Core (`UseSqlServer` / `UseNpgsql` / `UseMySql` / `UseSqlite`), Dapper, System.Data.SqlClient / Microsoft.Data.SqlClient, Npgsql, MySql.Data / MySqlConnector, MongoDB.Driver, StackExchange.Redis, AWS SDK (S3, DynamoDB)
+- **Auth packages** — `AddJwtBearer` (Microsoft.AspNetCore.Authentication.JwtBearer), `AddOpenIdConnect`, ASP.NET Identity (`UserManager`, `SignInManager`, `IdentityUser`, `PasswordHasher`), `[Authorize]` attribute, Duende IdentityServer, BCrypt.Net, Argon2
+- **HTTP clients (external calls)** — `HttpClient.GetAsync` / `PostAsync` / `SendAsync`, `HttpRequestMessage`, `RestClient` (RestSharp), `new Uri(...)`
+- **Secrets** — `Environment.GetEnvironmentVariable("...")`, `IConfiguration["..."]` / `Configuration["..."]` / `builder.Configuration["..."]` with secret-shaped keys, `GetConnectionString(...)`
+- **Service hints** — `<RootNamespace>` and `<AssemblyName>` from `.csproj`
+
+All emissions populate AttackMap's Signal v2 fields (line numbers, evidence snippets, confidence scores) so downstream insights can cite `path/to/file.cs:NN`.
+
+## Install
+
+```bash
+pip install git+https://github.com/mlaify/attackmap-analyzer-dotnet.git
+```
+
+The analyzer is auto-discovered by AttackMap via the `attackmap.analyzers` entry-point group.
+
+## Usage with AttackMap
+
+```bash
+# Auto-discovered when installed:
+attackmap analyze /path/to/dotnet/repo
+
+# Or invoke explicitly:
+attackmap analyze /path/to/dotnet/repo --module dotnet
+```
+
+## Detection
+
+`detect()` returns true when any of the following are present, ignoring `bin/`, `obj/`, `.vs/`, `.idea/`, `.git/`, `node_modules/`, `packages/`, `TestResults/`, and `publish/`:
+
+- A `.csproj`, `.fsproj`, or `.sln` file anywhere in the tree
+- A `.cs` file anywhere in the tree
+
+## Coverage notes
+
+- **Class-level `[Route]` prefix joining**: a controller annotated with `[Route("api/[controller]")]` or `[Route("api/orders")]` causes its method-level `[HttpGet("{id:int}")]` to emit as `api/Orders/{id:int}` (with `[controller]` substituted with the class name minus the `Controller` suffix). Multiple controllers per file are tracked correctly.
+- **Minimal API + controller routing in the same project**: both extractors run on every `.cs` file. The minimal-API regex looks for `app.Map*("...", handler)`; the controller regex looks for `[HttpX("...")]` attributes. They don't overlap.
+- **Connection strings as secrets**: `GetConnectionString("DefaultConnection")` is treated as a secret reference because the connection string itself is a credential. The named key (`DefaultConnection`) is stored as the secret name.
+- **F# (.fs) projects** are detected via `.fsproj` but route extraction is not yet implemented (Giraffe / Saturn).
+- **Razor Pages** (`@page` directives in `.cshtml` / `.razor`) are not yet covered. Most security-critical APIs use minimal APIs or controllers.
+
+## License
+
+MIT

attackmap_analyzer_dotnet-0.1.0/src/attackmap_analyzer_dotnet.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+src/attackmap_analyzer_dotnet/__init__.py
+src/attackmap_analyzer_dotnet/analyzer.py
+src/attackmap_analyzer_dotnet/contracts.py
+src/attackmap_analyzer_dotnet.egg-info/PKG-INFO
+src/attackmap_analyzer_dotnet.egg-info/SOURCES.txt
+src/attackmap_analyzer_dotnet.egg-info/dependency_links.txt
+src/attackmap_analyzer_dotnet.egg-info/entry_points.txt
+src/attackmap_analyzer_dotnet.egg-info/requires.txt
+src/attackmap_analyzer_dotnet.egg-info/top_level.txt
+tests/test_dotnet_analyzer.py

attackmap_analyzer_dotnet-0.1.0/src/attackmap_analyzer_dotnet.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

attackmap_analyzer_dotnet-0.1.0/src/attackmap_analyzer_dotnet.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[attackmap.analyzers]
+dotnet = attackmap_analyzer_dotnet:DotnetAnalyzer

attackmap_analyzer_dotnet-0.1.0/src/attackmap_analyzer_dotnet.egg-info/requires.txt

@@ -0,0 +1,9 @@
+pydantic>=2.7.0
+
+[core]
+attackmap>=0.1.0
+
+[dev]
+pytest>=8.0.0
+build>=1.2.0
+attackmap>=0.1.0

attackmap_analyzer_dotnet-0.1.0/src/attackmap_analyzer_dotnet.egg-info/top_level.txt

@@ -0,0 +1 @@
+attackmap_analyzer_dotnet

attackmap_analyzer_dotnet-0.1.0/tests/test_dotnet_analyzer.py

@@ -0,0 +1,420 @@
+"""Tests for the DotnetAnalyzer plugin."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from attackmap_analyzer_dotnet import DotnetAnalyzer
+
+
+# ---------- detect() ----------
+
+
+def test_detect_picks_up_csproj(tmp_path: Path) -> None:
+    (tmp_path / "demo.csproj").write_text("<Project></Project>", encoding="utf-8")
+    assert DotnetAnalyzer().detect(tmp_path) is True
+
+
+def test_detect_picks_up_solution(tmp_path: Path) -> None:
+    (tmp_path / "demo.sln").write_text("Microsoft Visual Studio Solution File\n", encoding="utf-8")
+    assert DotnetAnalyzer().detect(tmp_path) is True
+
+
+def test_detect_picks_up_bare_cs_file(tmp_path: Path) -> None:
+    (tmp_path / "Program.cs").write_text("class Program {}\n", encoding="utf-8")
+    assert DotnetAnalyzer().detect(tmp_path) is True
+
+
+def test_detect_skips_bin_obj(tmp_path: Path) -> None:
+    (tmp_path / "bin" / "Debug").mkdir(parents=True)
+    (tmp_path / "bin" / "Debug" / "leftover.cs").write_text("class X {}\n", encoding="utf-8")
+    assert DotnetAnalyzer().detect(tmp_path) is False
+
+
+# ---------- Minimal API routes ----------
+
+
+def test_minimal_api_map_methods_extracted(tmp_path: Path) -> None:
+    (tmp_path / "Program.cs").write_text(
+        'using Microsoft.AspNetCore.Builder;\n'
+        '\n'
+        'var builder = WebApplication.CreateBuilder(args);\n'
+        'var app = builder.Build();\n'
+        '\n'
+        'app.MapGet("/hello", () => "world");\n'
+        'app.MapPost("/users", (User u) => Results.Ok());\n'
+        'app.MapDelete("/users/{id:int}", (int id) => Results.NoContent());\n'
+        '\n'
+        'app.Run();\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    pairs = sorted({(r.path, r.method) for r in result.routes})
+    assert ("/hello", "GET") in pairs
+    assert ("/users", "POST") in pairs
+    assert ("/users/{id:int}", "DELETE") in pairs
+
+    hello = next(r for r in result.routes if r.path == "/hello")
+    assert hello.line == 6
+
+
+def test_minimal_api_map_methods_with_explicit_methods(tmp_path: Path) -> None:
+    (tmp_path / "Program.cs").write_text(
+        'using Microsoft.AspNetCore.Builder;\n'
+        'var app = WebApplication.CreateBuilder(args).Build();\n'
+        'app.MapMethods("/admin/maintenance", new[] { "GET", "POST" }, () => Results.Ok());\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    pairs = {(r.path, r.method) for r in result.routes}
+    assert ("/admin/maintenance", "GET") in pairs
+    assert ("/admin/maintenance", "POST") in pairs
+
+
+# ---------- Attribute routing ----------
+
+
+def test_attribute_routing_with_class_route_and_controller_token(tmp_path: Path) -> None:
+    src = tmp_path / "Controllers" / "UsersController.cs"
+    src.parent.mkdir(parents=True)
+    src.write_text(
+        'using Microsoft.AspNetCore.Mvc;\n'
+        '\n'
+        'namespace Demo.Api;\n'
+        '\n'
+        '[ApiController]\n'
+        '[Route("api/[controller]")]\n'
+        'public class UsersController : ControllerBase\n'
+        '{\n'
+        '    [HttpGet("{id:int}")]\n'
+        '    public IActionResult Get(int id) => Ok();\n'
+        '\n'
+        '    [HttpPost]\n'
+        '    public IActionResult Create([FromBody] User u) => Ok();\n'
+        '\n'
+        '    [HttpDelete("{id:int}")]\n'
+        '    public IActionResult Delete(int id) => NoContent();\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    pairs = sorted({(r.path, r.method) for r in result.routes})
+    assert ("api/Users/{id:int}", "GET") in pairs
+    assert ("api/Users", "POST") in pairs
+    assert ("api/Users/{id:int}", "DELETE") in pairs
+
+
+def test_attribute_routing_with_explicit_class_path(tmp_path: Path) -> None:
+    src = tmp_path / "OrdersController.cs"
+    src.write_text(
+        'using Microsoft.AspNetCore.Mvc;\n'
+        '\n'
+        '[ApiController]\n'
+        '[Route("api/orders/v2")]\n'
+        'public class OrdersController : ControllerBase\n'
+        '{\n'
+        '    [HttpGet]\n'
+        '    public IActionResult List() => Ok();\n'
+        '\n'
+        '    [HttpPost("refund")]\n'
+        '    public IActionResult Refund() => Ok();\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    pairs = {(r.path, r.method) for r in result.routes}
+    assert ("api/orders/v2", "GET") in pairs
+    assert ("api/orders/v2/refund", "POST") in pairs
+
+
+def test_attribute_routing_handles_two_controllers_in_one_file(tmp_path: Path) -> None:
+    src = tmp_path / "MultipleControllers.cs"
+    src.write_text(
+        'using Microsoft.AspNetCore.Mvc;\n'
+        '\n'
+        '[Route("api/a")]\n'
+        'public class AController : ControllerBase {\n'
+        '    [HttpGet("x")]\n'
+        '    public IActionResult X() => Ok();\n'
+        '}\n'
+        '\n'
+        '[Route("api/b")]\n'
+        'public class BController : ControllerBase {\n'
+        '    [HttpGet("y")]\n'
+        '    public IActionResult Y() => Ok();\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    pairs = {(r.path, r.method) for r in result.routes}
+    assert ("api/a/x", "GET") in pairs
+    assert ("api/b/y", "GET") in pairs
+    assert ("api/a/y", "GET") not in pairs
+    assert ("api/b/x", "GET") not in pairs
+
+
+# ---------- Databases ----------
+
+
+def test_efcore_use_npgsql_emits_postgresql(tmp_path: Path) -> None:
+    (tmp_path / "DbStartup.cs").write_text(
+        'using Microsoft.EntityFrameworkCore;\n'
+        'public class Startup {\n'
+        '    public void ConfigureServices(IServiceCollection services) {\n'
+        '        services.AddDbContext<MyContext>(opt => opt.UseNpgsql("..."));\n'
+        '    }\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    assert any(d.kind == "postgresql" for d in result.databases)
+
+
+def test_mongo_redis_each_emit_distinct_kinds(tmp_path: Path) -> None:
+    (tmp_path / "Mongo.cs").write_text(
+        'using MongoDB.Driver;\npublic class M { IMongoDatabase Db; }\n',
+        encoding="utf-8",
+    )
+    (tmp_path / "Redis.cs").write_text(
+        'using StackExchange.Redis;\n'
+        'public class R { void X() { ConnectionMultiplexer.Connect("localhost"); } }\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    kinds = {d.kind for d in result.databases}
+    assert "mongodb" in kinds
+    assert "redis" in kinds
+
+
+def test_dapper_emits_sql_hint(tmp_path: Path) -> None:
+    (tmp_path / "Repo.cs").write_text(
+        'using Dapper;\n'
+        'using System.Data;\n'
+        'public class Repo { public Repo(IDbConnection conn) { } }\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    assert any(d.kind == "sql" for d in result.databases)
+
+
+# ---------- Auth ----------
+
+
+def test_jwt_bearer_setup(tmp_path: Path) -> None:
+    (tmp_path / "Program.cs").write_text(
+        'using Microsoft.AspNetCore.Authentication.JwtBearer;\n'
+        'var builder = WebApplication.CreateBuilder(args);\n'
+        'builder.Services.AddAuthentication().AddJwtBearer(options => { });\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    assert any(h.hint == "jwt" for h in result.auth_hints)
+
+
+def test_authorize_attribute_emits_hint(tmp_path: Path) -> None:
+    (tmp_path / "Sec.cs").write_text(
+        'using Microsoft.AspNetCore.Authorization;\n'
+        'using Microsoft.AspNetCore.Mvc;\n'
+        '\n'
+        '[Authorize(Roles = "Admin")]\n'
+        'public class AdminController : ControllerBase { }\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    assert any(h.hint == "authorize_attribute" for h in result.auth_hints)
+
+
+def test_identity_signals(tmp_path: Path) -> None:
+    (tmp_path / "Auth.cs").write_text(
+        'using Microsoft.AspNetCore.Identity;\n'
+        'public class Service {\n'
+        '    private readonly UserManager<IdentityUser> _userManager;\n'
+        '    public Service(UserManager<IdentityUser> um) { _userManager = um; }\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    assert any(h.hint == "aspnet_identity" for h in result.auth_hints)
+
+
+# ---------- Secrets ----------
+
+
+def test_environment_getenv_secrets(tmp_path: Path) -> None:
+    (tmp_path / "Cfg.cs").write_text(
+        'public class Cfg {\n'
+        '    string s = Environment.GetEnvironmentVariable("JWT_SECRET");\n'
+        '    string p = Environment.GetEnvironmentVariable("DATABASE_PASSWORD");\n'
+        '    string a = Environment.GetEnvironmentVariable("STRIPE_API_KEY");\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    names = {s.name for s in result.secret_hints}
+    assert "JWT_SECRET" in names
+    assert "DATABASE_PASSWORD" in names
+    assert "STRIPE_API_KEY" in names
+
+    jwt = next(s for s in result.secret_hints if s.name == "JWT_SECRET")
+    assert jwt.line == 2
+
+
+def test_iconfiguration_secret_keys(tmp_path: Path) -> None:
+    (tmp_path / "Cfg.cs").write_text(
+        'public class Cfg {\n'
+        '    public Cfg(IConfiguration cfg) {\n'
+        '        var s = cfg["Auth:JwtSecret"];\n'
+        '        var k = builder.Configuration["Stripe:ApiKey"];\n'
+        '    }\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    names_lower = {s.name.lower() for s in result.secret_hints}
+    assert any("jwtsecret" in n.replace(":", "") for n in names_lower)
+    assert any("apikey" in n.replace(":", "") for n in names_lower)
+
+
+def test_connection_string_extracted(tmp_path: Path) -> None:
+    (tmp_path / "Cfg.cs").write_text(
+        'public class Startup {\n'
+        '    public void Configure(IConfiguration cfg) {\n'
+        '        var conn = cfg.GetConnectionString("DefaultConnection");\n'
+        '    }\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    names = {s.name for s in result.secret_hints}
+    assert "DefaultConnection" in names
+
+
+# ---------- External calls ----------
+
+
+def test_httpclient_getasync_extracted(tmp_path: Path) -> None:
+    (tmp_path / "Client.cs").write_text(
+        'using System.Net.Http;\n'
+        'public class Client {\n'
+        '    private readonly HttpClient _httpClient;\n'
+        '    public async Task Fetch() {\n'
+        '        await _httpClient.GetAsync("https://api.stripe.com/v1/charges");\n'
+        '    }\n'
+        '}\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    targets = {e.target for e in result.external_calls}
+    assert "https://api.stripe.com/v1/charges" in targets
+
+
+# ---------- Frameworks + entrypoints ----------
+
+
+def test_aspnetcore_application_markers(tmp_path: Path) -> None:
+    (tmp_path / "Program.cs").write_text(
+        'using Microsoft.AspNetCore.Builder;\n'
+        '\n'
+        'var builder = WebApplication.CreateBuilder(args);\n'
+        'var app = builder.Build();\n'
+        'app.MapGet("/", () => "hello");\n'
+        'app.Run();\n',
+        encoding="utf-8",
+    )
+    result = DotnetAnalyzer().analyze(tmp_path)
+    fw = {f.hint for f in result.framework_hints}
+    assert "aspnetcore" in fw
+
+    ep = {e.hint for e in result.entrypoint_hints}
+    assert "webapplication_builder" in ep
+    assert "webapp_run" in ep
+
+
+# ---------- Build metadata → service hints ----------
+
+
+def test_csproj_root_namespace_picked_up(tmp_path: Path) -> None:
+    (tmp_path / "Demo.Api.csproj").write_text(
+        "<Project Sdk=\"Microsoft.NET.Sdk\">\n"
+        "  <PropertyGroup>\n"
+        "    <RootNamespace>Acme.Billing.Api</RootNamespace>\n"
+        "    <AssemblyName>Acme.Billing.Api</AssemblyName>\n"
+        "  </PropertyGroup>\n"
+        "</Project>\n",
+        encoding="utf-8",
+    )
+    (tmp_path / "Program.cs").write_text("class P {}\n", encoding="utf-8")
+    result = DotnetAnalyzer().analyze(tmp_path)
+    hints = {h.hint for h in result.service_hints}
+    assert "namespace:Acme.Billing.Api" in hints
+    assert "assembly:Acme.Billing.Api" in hints
+
+
+# ---------- End-to-end sanity ----------
+
+
+def test_full_aspnetcore_service_signal_set(tmp_path: Path) -> None:
+    (tmp_path / "Demo.csproj").write_text(
+        "<Project><PropertyGroup><RootNamespace>Demo</RootNamespace></PropertyGroup></Project>\n",
+        encoding="utf-8",
+    )
+
+    (tmp_path / "Program.cs").write_text(
+        'using Microsoft.AspNetCore.Authentication.JwtBearer;\n'
+        'using Microsoft.AspNetCore.Builder;\n'
+        'using Microsoft.EntityFrameworkCore;\n'
+        '\n'
+        'var builder = WebApplication.CreateBuilder(args);\n'
+        'builder.Services.AddDbContext<MyContext>(opt => opt.UseNpgsql("..."));\n'
+        'builder.Services.AddAuthentication().AddJwtBearer();\n'
+        'var app = builder.Build();\n'
+        'app.MapGet("/health", () => "ok");\n'
+        'app.Run();\n',
+        encoding="utf-8",
+    )
+
+    src = tmp_path / "Controllers" / "OrdersController.cs"
+    src.parent.mkdir()
+    src.write_text(
+        'using Microsoft.AspNetCore.Mvc;\n'
+        'using Microsoft.AspNetCore.Authorization;\n'
+        '\n'
+        '[ApiController]\n'
+        '[Route("api/[controller]")]\n'
+        '[Authorize]\n'
+        'public class OrdersController : ControllerBase\n'
+        '{\n'
+        '    [HttpGet("{id:int}")]\n'
+        '    public IActionResult Get(int id) => Ok();\n'
+        '\n'
+        '    [HttpPost("admin/refund")]\n'
+        '    public IActionResult Refund() => Ok();\n'
+        '\n'
+        '    private readonly HttpClient _httpClient;\n'
+        '    public async Task Charge() {\n'
+        '        var key = Environment.GetEnvironmentVariable("STRIPE_API_KEY");\n'
+        '        await _httpClient.GetAsync("https://api.stripe.com/v1/charges");\n'
+        '    }\n'
+        '}\n',
+        encoding="utf-8",
+    )
+
+    result = DotnetAnalyzer().analyze(tmp_path)
+
+    pairs = {(r.path, r.method) for r in result.routes}
+    assert ("/health", "GET") in pairs
+    assert ("api/Orders/{id:int}", "GET") in pairs
+    assert ("api/Orders/admin/refund", "POST") in pairs
+
+    assert any(d.kind == "postgresql" for d in result.databases)
+    assert any(h.hint == "jwt" for h in result.auth_hints)
+    assert any(h.hint == "authorize_attribute" for h in result.auth_hints)
+    assert "STRIPE_API_KEY" in {s.name for s in result.secret_hints}
+    assert any(e.target == "https://api.stripe.com/v1/charges" for e in result.external_calls)
+    assert any(f.hint == "aspnetcore" for f in result.framework_hints)
+    assert any(e.hint == "webapp_run" for e in result.entrypoint_hints)
+    assert any(h.hint == "namespace:Demo" for h in result.service_hints)
+
+    assert all(r.line is not None for r in result.routes)