.NET / C# source review

When it applies

Reviewing C#/.NET source (ASP.NET Core, MVC, or legacy WebForms). The headline risks are unsafe deserialization, string-built SQL, XXE, and Razor's raw-output escape hatch.

Why it works

.NET ships powerful-but-dangerous serializers (BinaryFormatter, Json.NET with TypeNameHandling, LosFormatter/ViewState) that instantiate arbitrary types, and several XML APIs resolve DTDs by default on older frameworks. Reviews find where these meet untrusted input.