Microsoft.CodeAnalysis.FxCopAnalyzers.md

Sr. No.	Rule ID	Title	Category	Enabled	CodeFix	Description
1	CA1000	Do not declare static members on generic types	Design	True	False	When a static member of a generic type is called, the type argument must be specified for the type. When a generic instance member that does not support inference is called, the type argument must be specified for the member. In these two cases, the syntax for specifying the type argument is different and easily confused.
2	CA1001	Types that own disposable fields should be disposable	Design	True	True	A class declares and implements an instance field that is a System.IDisposable type, and the class does not implement IDisposable. A class that declares an IDisposable field indirectly owns an unmanaged resource and should implement the IDisposable interface.
3	CA1003	Use generic event handler instances	Design	False	True	A type contains an event that declares an EventHandler delegate that returns void, whose signature contains two parameters (the first an object and the second a type that is assignable to EventArgs), and the containing assembly targets Microsoft .NET Framework?2.0.
4	CA1008	Enums should have zero value	Design	False	True	The default value of an uninitialized enumeration, just as other value types, is zero. A nonflags-attributed enumeration should define a member by using the value of zero so that the default value is a valid value of the enumeration. If an enumeration that has the FlagsAttribute attribute applied defines a zero-valued member, its name should be ""None"" to indicate that no values have been set in the enumeration.
5	CA1010	Collections should implement generic interface	Design	True	True	To broaden the usability of a collection, implement one of the generic collection interfaces. Then the collection can be used to populate generic collection types.
6	CA1012	Abstract types should not have constructors	Design	False	True	Constructors on abstract types can be called only by derived types. Because public constructors create instances of a type, and you cannot create instances of an abstract type, an abstract type that has a public constructor is incorrectly designed.
7	CA1014	Mark assemblies with CLSCompliant	Design	False	True	The Common Language Specification (CLS) defines naming restrictions, data types, and rules to which assemblies must conform if they will be used across programming languages. Good design dictates that all assemblies explicitly indicate CLS compliance by using CLSCompliantAttribute . If this attribute is not present on an assembly, the assembly is not compliant.
8	CA1016	Mark assemblies with assembly version	Design	True	True	The .NET Framework uses the version number to uniquely identify an assembly, and to bind to types in strongly named assemblies. The version number is used together with version and publisher policy. By default, applications run only with the assembly version with which they were built.
9	CA1017	Mark assemblies with ComVisible	Design	False	False	ComVisibleAttribute determines how COM clients access managed code. Good design dictates that assemblies explicitly indicate COM visibility. COM visibility can be set for the whole assembly and then overridden for individual types and type members. If this attribute is not present, the contents of the assembly are visible to COM clients.
10	CA1018	Mark attributes with AttributeUsageAttribute	Design	True	False	Specify AttributeUsage on {0}.
11	CA1019	Define accessors for attribute arguments	Design	False	True	Remove the property setter from {0} or reduce its accessibility because it corresponds to positional argument {1}.
12	CA1024	Use properties where appropriate	Design	False	True	A public or protected method has a name that starts with ""Get"", takes no parameters, and returns a value that is not an array. The method might be a good candidate to become a property.
13	CA1027	Mark enums with FlagsAttribute	Design	False	True	An enumeration is a value type that defines a set of related named constants. Apply FlagsAttribute to an enumeration when its named constants can be meaningfully combined.
14	CA1028	Enum Storage should be Int32	Design	True	True	An enumeration is a value type that defines a set of related named constants. By default, the System.Int32 data type is used to store the constant value. Although you can change this underlying type, it is not required or recommended for most scenarios.
15	CA1030	Use events where appropriate	Design	True	True	This rule detects methods that have names that ordinarily would be used for events. If a method is called in response to a clearly defined state change, the method should be invoked by an event handler. Objects that call the method should raise events instead of calling the method directly.
16	CA1031	Do not catch general exception types	Design	True	False	A general exception such as System.Exception or System.SystemException is caught in a catch statement, or a general catch clause is used. General exceptions should not be caught.
17	CA1032	Implement standard exception constructors	Design	True	True	Failure to provide the full set of constructors can make it difficult to correctly handle exceptions.
18	CA1033	Interface methods should be callable by child types	Design	False	True	An unsealed externally visible type provides an explicit method implementation of a public interface and does not provide an alternative externally visible method that has the same name.
19	CA1034	Nested types should not be visible	Design	True	False	A nested type is a type that is declared in the scope of another type. Nested types are useful to encapsulate private implementation details of the containing type. Used for this purpose, nested types should not be externally visible.
20	CA1036	Override methods on comparable types	Design	True	True	A public or protected type implements the System.IComparable interface. It does not override Object.Equals nor does it overload the language-specific operator for equality, inequality, less than, less than or equal, greater than or greater than or equal.
21	CA1040	Avoid empty interfaces	Design	True	True	Interfaces define members that provide a behavior or usage contract. The functionality that is described by the interface can be adopted by any type, regardless of where the type appears in the inheritance hierarchy. A type implements an interface by providing implementations for the members of the interface. An empty interface does not define any members; therefore, it does not define a contract that can be implemented.
22	CA1041	Provide ObsoleteAttribute message	Design	True	False	A type or member is marked by using a System.ObsoleteAttribute attribute that does not have its ObsoleteAttribute.Message property specified. When a type or member that is marked by using ObsoleteAttribute is compiled, the Message property of the attribute is displayed. This gives the user information about the obsolete type or member.
23	CA1043	Use Integral Or String Argument For Indexers	Design	True	False	Indexers, that is, indexed properties, should use integer or string types for the index. These types are typically used for indexing data structures and increase the usability of the library. Use of the Object type should be restricted to those cases where the specific integer or string type cannot be specified at design time. If the design requires other types for the index, reconsider whether the type represents a logical data store. If it does not represent a logical data store, use a method.
24	CA1044	Properties should not be write only	Design	True	False	Although it is acceptable and often necessary to have a read-only property, the design guidelines prohibit the use of write-only properties. This is because letting a user set a value, and then preventing the user from viewing that value, does not provide any security. Also, without read access, the state of shared objects cannot be viewed, which limits their usefulness.
25	CA1050	Declare types in namespaces	Design	False	True	Types are declared in namespaces to prevent name collisions and as a way to organize related types in an object hierarchy.
26	CA1051	Do not declare visible instance fields	Design	True	False	The primary use of a field should be as an implementation detail. Fields should be private or internal and should be exposed by using properties.
27	CA1052	Static holder types should be Static or NotInheritable	Design	True	True	Type '{0}' is a static holder type but is neither static nor NotInheritable
28	CA1054	Uri parameters should not be strings	Design	True	True	If a method takes a string representation of a URI, a corresponding overload should be provided that takes an instance of the URI class, which provides these services in a safe and secure manner.
29	CA1055	Uri return values should not be strings	Design	True	False	This rule assumes that the method returns a URI. A string representation of a URI is prone to parsing and encoding errors, and can lead to security vulnerabilities. The System.Uri class provides these services in a safe and secure manner.
30	CA1056	Uri properties should not be strings	Design	True	False	This rule assumes that the property represents a Uniform Resource Identifier (URI). A string representation of a URI is prone to parsing and encoding errors, and can lead to security vulnerabilities. The System.Uri class provides these services in a safe and secure manner.
31	CA1058	Types should not extend certain base types	Design	True	True	An externally visible type extends certain base types. Use one of the alternatives.
32	CA1060	Move pinvokes to native methods class	Design	False	True	Platform Invocation methods, such as those that are marked by using the System.Runtime.InteropServices.DllImportAttribute attribute, or methods that are defined by using the Declare keyword in Visual Basic, access unmanaged code. These methods should be of the NativeMethods, SafeNativeMethods, or UnsafeNativeMethods class.
33	CA1061	Do not hide base class methods	Design	True	True	A method in a base type is hidden by an identically named method in a derived type when the parameter signature of the derived method differs only by types that are more weakly derived than the corresponding types in the parameter signature of the base method.
34	CA1062	Validate arguments of public methods	Design	True	False	An externally visible method dereferences one of its reference arguments without verifying whether that argument is null (Nothing in Visual Basic). All reference arguments that are passed to externally visible methods should be checked against null. If appropriate, throw an ArgumentNullException when the argument is null or add a Code Contract precondition asserting non-null argument. If the method is designed to be called only by known assemblies, you should make the method internal.
35	CA1063	Implement IDisposable Correctly	Design	True	True	All IDisposable types should implement the Dispose pattern correctly.
36	CA1064	Exceptions should be public	Design	True	True	An internal exception is visible only inside its own internal scope. After the exception falls outside the internal scope, only the base exception can be used to catch the exception. If the internal exception is inherited from T:System.Exception, T:System.SystemException, or T:System.ApplicationException, the external code will not have sufficient information to know what to do with the exception.
37	CA1065	Do not raise exceptions in unexpected locations	Design	True	False	A method that is not expected to throw exceptions throws an exception.
38	CA1066	Type {0} should implement IEquatable because it overrides Equals	Design	True	True	When a type T overrides Object.Equals(object), the implementation must cast the object argument to the correct type T before performing the comparison. If the type implements IEquatable, and therefore offers the method T.Equals(T), and if the argument is known at compile time to be of type T, then the compiler can call IEquatable.Equals(T) instead of Object.Equals(object), and no cast is necessary, improving performance.
39	CA1067	Override Object.Equals(object) when implementing IEquatable	Design	True	True	When a type T implements the interface IEquatable, it suggests to a user who sees a call to the Equals method in source code that an instance of the type can be equated with an instance of any other type. The user might be confused if their attempt to equate the type with an instance of another type fails to compile. This violates the "principle of least surprise".
40	CA1068	CancellationToken parameters must come last	Design	True	False	Method '{0}' should take CancellationToken as the last parameter
41	CA1200	Avoid using cref tags with a prefix	Documentation	True	True	Use of cref tags with prefixes should be avoided, since it prevents the compiler from verifying references and the IDE from updating references during refactorings. It is permissible to suppress this error at a single documentation site if the cref must use a prefix because the type being mentioned is not findable by the compiler. For example, if a cref is mentioning a special attribute in the full framework but you're in a file that compiles against the portable framework, or if you want to reference a type at higher layer of Roslyn, you should suppress the error. You should not suppress the error just because you want to take a shortcut and avoid using the full syntax.
42	CA1303	Do not pass literals as localized parameters	Globalization	True	False	A method passes a string literal as a parameter to a constructor or method in the .NET Framework class library and that string should be localizable. To fix a violation of this rule, replace the string literal with a string retrieved through an instance of the ResourceManager class.
43	CA1304	Specify CultureInfo	Globalization	True	True	A method or constructor calls a member that has an overload that accepts a System.Globalization.CultureInfo parameter, and the method or constructor does not call the overload that takes the CultureInfo parameter. When a CultureInfo or System.IFormatProvider object is not supplied, the default value that is supplied by the overloaded member might not have the effect that you want in all locales. If the result will be displayed to the user, specify 'CultureInfo.CurrentCulture' as the 'CultureInfo' parameter. Otherwise, if the result will be stored and accessed by software, such as when it is persisted to disk or to a database, specify 'CultureInfo.InvariantCulture'.
44	CA1305	Specify IFormatProvider	Globalization	True	True	A method or constructor calls one or more members that have overloads that accept a System.IFormatProvider parameter, and the method or constructor does not call the overload that takes the IFormatProvider parameter. When a System.Globalization.CultureInfo or IFormatProvider object is not supplied, the default value that is supplied by the overloaded member might not have the effect that you want in all locales. If the result will be based on the input from/output displayed to the user, specify 'CultureInfo.CurrentCulture' as the 'IFormatProvider'. Otherwise, if the result will be stored and accessed by software, such as when it is loaded from disk/database and when it is persisted to disk/database, specify 'CultureInfo.InvariantCulture'
45	CA1307	Specify StringComparison	Globalization	True	True	A string comparison operation uses a method overload that does not set a StringComparison parameter. If the result will be displayed to the user, such as when sorting a list of items for display in a list box, specify 'StringComparison.CurrentCulture' or 'StringComparison.CurrentCultureIgnoreCase' as the 'StringComparison' parameter. If comparing case-insensitive identifiers, such as file paths, environment variables, or registry keys and values, specify 'StringComparison.OrdinalIgnoreCase'. Otherwise, if comparing case-sensitive identifiers, specify 'StringComparison.Ordinal'.
46	CA1308	Normalize strings to uppercase	Globalization	True	True	Strings should be normalized to uppercase. A small group of characters cannot make a round trip when they are converted to lowercase. To make a round trip means to convert the characters from one locale to another locale that represents character data differently, and then to accurately retrieve the original characters from the converted characters.
47	CA1309	Use ordinal stringcomparison	Globalization	False	True	A string comparison operation that is nonlinguistic does not set the StringComparison parameter to either Ordinal or OrdinalIgnoreCase. By explicitly setting the parameter to either StringComparison.Ordinal or StringComparison.OrdinalIgnoreCase, your code often gains speed, becomes more correct, and becomes more reliable.
48	CA1401	P/Invokes should not be visible	Interoperability	True	False	A public or protected method in a public type has the System.Runtime.InteropServices.DllImportAttribute attribute (also implemented by the Declare keyword in Visual Basic). Such methods should not be exposed.
49	CA1501	Avoid excessive inheritance	Maintainability	False	False	Deeply nested type hierarchies can be difficult to follow, understand, and maintain. This rule limits analysis to hierarchies in the same module. To fix a violation of this rule, derive the type from a base type that is less deep in the inheritance hierarchy or eliminate some of the intermediate base types.
50	CA1502	Avoid excessive complexity	Maintainability	False	False	Cyclomatic complexity measures the number of linearly independent paths through the method, which is determined by the number and complexity of conditional branches. A low cyclomatic complexity generally indicates a method that is easy to understand, test, and maintain. The cyclomatic complexity is calculated from a control flow graph of the method and is given as follows: cyclomatic complexity = the number of edges - the number of nodes + 1, where a node represents a logic branch point and an edge represents a line between nodes.
51	CA1505	Avoid unmaintainable code	Maintainability	False	False	The maintainability index is calculated by using the following metrics: lines of code, program volume, and cyclomatic complexity. Program volume is a measure of the difficulty of understanding of a symbol that is based on the number of operators and operands in the code. Cyclomatic complexity is a measure of the structural complexity of the type or method. A low maintainability index indicates that code is probably difficult to maintain and would be a good candidate to redesign.
52	CA1506	Avoid excessive class coupling	Maintainability	False	False	This rule measures class coupling by counting the number of unique type references that a symbol contains. Symbols that have a high degree of class coupling can be difficult to maintain. It is a good practice to have types and methods that exhibit low coupling and high cohesion. To fix this violation, try to redesign the code to reduce the number of types to which it is coupled.
53	CA1507	Use nameof to express symbol names	Maintainability	True	True	Using nameof helps keep your code valid when refactoring.
54	CA1508	Avoid dead conditional code	Maintainability	False	False	'{0}' is always '{1}'. Remove or refactor the condition(s) to avoid dead code.
55	CA1509	Invalid entry in code metrics rule specification file	Maintainability	False	False	Invalid entry in code metrics rule specification file
56	CA1707	Identifiers should not contain underscores	Naming	True	True	By convention, identifier names do not contain the underscore (_) character. This rule checks namespaces, types, members, and parameters.
57	CA1708	Identifiers should differ by more than case	Naming	False	False	Identifiers for namespaces, types, members, and parameters cannot differ only by case because languages that target the common language runtime are not required to be case-sensitive.
58	CA1710	Identifiers should have correct suffix	Naming	True	True	By convention, the names of types that extend certain base types or that implement certain interfaces, or types that are derived from these types, have a suffix that is associated with the base type or interface.
59	CA1711	Identifiers should not have incorrect suffix	Naming	False	True	By convention, only the names of types that extend certain base types or that implement certain interfaces, or types that are derived from these types, should end with specific reserved suffixes. Other type names should not use these reserved suffixes.
60	CA1712	Do not prefix enum values with type name	Naming	True	False	An enumeration's values should not start with the type name of the enumeration.
61	CA1714	Flags enums should have plural names	Naming	True	True	A public enumeration has the System.FlagsAttribute attribute, and its name does not end in ""s"". Types that are marked by using FlagsAttribute have names that are plural because the attribute indicates that more than one value can be specified.
62	CA1715	Identifiers should have correct prefix	Naming	True	True	Identifiers should have correct prefix
63	CA1716	Identifiers should not match keywords	Naming	True	True	A namespace name or a type name matches a reserved keyword in a programming language. Identifiers for namespaces and types should not match keywords that are defined by languages that target the common language runtime.
64	CA1717	Only FlagsAttribute enums should have plural names	Naming	True	True	Naming conventions dictate that a plural name for an enumeration indicates that more than one value of the enumeration can be specified at the same time.
65	CA1720	Identifier contains type name	Naming	True	False	Names of parameters and members are better used to communicate their meaning than to describe their type, which is expected to be provided by development tools. For names of members, if a data type name must be used, use a language-independent name instead of a language-specific one.
66	CA1721	Property names should not match get methods	Naming	True	True	The name of a public or protected member starts with ""Get"" and otherwise matches the name of a public or protected property. ""Get"" methods and properties should have names that clearly distinguish their function.
67	CA1724	Type names should not match namespaces	Naming	True	True	Type names should not match the names of namespaces that are defined in the .NET Framework class library. Violating this rule can reduce the usability of the library.
68	CA1725	Parameter names should match base declaration	Naming	False	True	Consistent naming of parameters in an override hierarchy increases the usability of the method overrides. A parameter name in a derived method that differs from the name in the base declaration can cause confusion about whether the method is an override of the base method or a new overload of the method.
69	CA1801	Review unused parameters	Usage	True	True	Avoid unused paramereters in your code. If the parameter cannot be removed, then change its name so it starts with an underscore and is optionally followed by an integer, such as '_', '_1', '_2', etc. These are treated as special discard symbol names.
70	CA1802	Use literals where appropriate	Performance	True	True	A field is declared static and read-only (Shared and ReadOnly in Visual Basic), and is initialized by using a value that is computable at compile time. Because the value that is assigned to the targeted field is computable at compile time, change the declaration to a const (Const in Visual Basic) field so that the value is computed at compile time instead of at run?time.
71	CA1806	Do not ignore method results	Performance	True	False	A new object is created but never used; or a method that creates and returns a new string is called and the new string is never used; or a COM or P/Invoke method returns an HRESULT or error code that is never used.
72	CA1810	Initialize reference type static fields inline	Performance	True	True	A reference type declares an explicit static constructor. To fix a violation of this rule, initialize all static data when it is declared and remove the static constructor.
73	CA1812	Avoid uninstantiated internal classes	Performance	True	True	An instance of an assembly-level type is not created by code in the assembly.
74	CA1813	Avoid unsealed attributes	Performance	False	True	The .NET Framework class library provides methods for retrieving custom attributes. By default, these methods search the attribute inheritance hierarchy. Sealing the attribute eliminates the search through the inheritance hierarchy and can improve performance.
75	CA1814	Prefer jagged arrays over multidimensional	Performance	True	True	A jagged array is an array whose elements are arrays. The arrays that make up the elements can be of different sizes, leading to less wasted space for some sets of data.
76	CA1815	Override equals and operator equals on value types	Performance	True	True	For value types, the inherited implementation of Equals uses the Reflection library and compares the contents of all fields. Reflection is computationally expensive, and comparing every field for equality might be unnecessary. If you expect users to compare or sort instances, or to use instances as hash table keys, your value type should implement Equals.
77	CA1816	Dispose methods should call SuppressFinalize	Usage	True	True	A method that is an implementation of Dispose does not call GC.SuppressFinalize; or a method that is not an implementation of Dispose calls GC.SuppressFinalize; or a method calls GC.SuppressFinalize and passes something other than this (Me in Visual?Basic).
78	CA1819	Properties should not return arrays	Performance	True	False	Arrays that are returned by properties are not write-protected, even when the property is read-only. To keep the array tamper-proof, the property must return a copy of the array. Typically, users will not understand the adverse performance implications of calling such a property.
79	CA1820	Test for empty strings using string length	Performance	True	True	Comparing strings by using the String.Length property or the String.IsNullOrEmpty method is significantly faster than using Equals.
80	CA1821	Remove empty Finalizers	Performance	True	True	Finalizers should be avoided where possible, to avoid the additional performance overhead involved in tracking object lifetime.
81	CA1822	Mark members as static	Performance	True	True	Members that do not access instance data or call instance methods can be marked as static (Shared in Visual Basic). After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code.
82	CA1823	Avoid unused private fields	Performance	True	True	Private fields were detected that do not appear to be accessed in the assembly.
83	CA1824	Mark assemblies with NeutralResourcesLanguageAttribute	Performance	True	False	The NeutralResourcesLanguage attribute informs the ResourceManager of the language that was used to display the resources of a neutral culture for an assembly. This improves lookup performance for the first resource that you load and can reduce your working set.
84	CA1825	Avoid zero-length array allocations.	Performance	True	True	Avoid unnecessary zero-length array allocations. Use {0} instead.
85	CA1826	Do not use Enumerable methods on indexable collections. Instead use the collection directly	Performance	True	True	This collection is directly indexable. Going through LINQ here causes unnecessary allocations and CPU work.
86	CA1827	Do not use Count() or LongCount() when Any() can be used	Performance	True	True	For non-empty collections, Count() and LongCount() enumerate the entire sequence, while Any() stops at the first item or the first item that satisfies a condition.
87	CA1828	Do not use CountAsync() or LongCountAsync() when AnyAsync() can be used	Performance	True	True	For non-empty collections, CountAsync() and LongCountAsync() enumerate the entire sequence, while AnyAsync() stops at the first item or the first item that satisfies a condition.
88	CA1829	Use Length/Count property instead of Count() when available	Performance	True	True	Enumerable.Count() potentially enumerates the sequence while a Length/Count property is a direct access.
89	CA2000	Dispose objects before losing scope	Reliability	True	False	If a disposable object is not explicitly disposed before all references to it are out of scope, the object will be disposed at some indeterminate time when the garbage collector runs the finalizer of the object. Because an exceptional event might occur that will prevent the finalizer of the object from running, the object should be explicitly disposed instead.
90	CA2002	Do not lock on objects with weak identity	Reliability	True	False	An object is said to have a weak identity when it can be directly accessed across application domain boundaries. A thread that tries to acquire a lock on an object that has a weak identity can be blocked by a second thread in a different application domain that has a lock on the same object.
91	CA2007	Consider calling ConfigureAwait on the awaited task	Reliability	True	True	When an asynchronous method awaits a Task directly, continuation occurs in the same thread that created the task. Consider calling Task.ConfigureAwait(Boolean) to signal your intention for continuation. Call ConfigureAwait(false) on the task to schedule continuations to the thread pool, thereby avoiding a deadlock on the UI thread. Passing false is a good option for app-independent libraries. Calling ConfigureAwait(true) on the task has the same behavior as not explicitly calling ConfigureAwait. By explicitly calling this method, you're letting readers know you intentionally want to perform the continuation on the original synchronization context.
92	CA2008	Do not create tasks without passing a TaskScheduler	Reliability	True	True	Do not create tasks unless you are using one of the overloads that takes a TaskScheduler. The default is to schedule on TaskScheduler.Current, which would lead to deadlocks. Either use TaskScheduler.Default to schedule on the thread pool, or explicitly pass TaskScheduler.Current to make your intentions clear.
93	CA2009	Do not call ToImmutableCollection on an ImmutableCollection value	Reliability	True	True	Do not call {0} on an {1} value
94	CA2010	Always consume the value returned by methods marked with PreserveSigAttribute	Reliability	True	False	PreserveSigAttribute indicates that a method will return an HRESULT, rather than throwing an exception. Therefore, it is important to consume the HRESULT returned by the method, so that errors can be detected. Generally, this is done by calling Marshal.ThrowExceptionForHR.
95	CA2100	Review SQL queries for security vulnerabilities	Security	True	False	SQL queries that directly use user input can be vulnerable to SQL injection attacks. Review this SQL query for potential vulnerabilities, and consider using a parameterized SQL query.
96	CA2101	Specify marshaling for P/Invoke string arguments	Globalization	True	True	A platform invoke member allows partially trusted callers, has a string parameter, and does not explicitly marshal the string. This can cause a potential security vulnerability.
97	CA2119	Seal methods that satisfy private interfaces	Security	True	True	An inheritable public type provides an overridable method implementation of an internal (Friend in Visual Basic) interface. To fix a violation of this rule, prevent the method from being overridden outside the assembly.
98	CA2153	Do Not Catch Corrupted State Exceptions	Security	True	False	Catching corrupted state exceptions could mask errors (such as access violations), resulting in inconsistent state of execution or making it easier for attackers to compromise system. Instead, catch and handle a more specific set of exception type(s) or re-throw the exception
99	CA2200	Rethrow to preserve stack details.	Usage	True	False	Re-throwing caught exception changes stack information.
100	CA2201	Do not raise reserved exception types	Usage	False	False	An exception of type that is not sufficiently specific or reserved by the runtime should never be raised by user code. This makes the original error difficult to detect and debug. If this exception instance might be thrown, use a different exception type.
101	CA2207	Initialize value type static fields inline	Usage	True	True	A value type declares an explicit static constructor. To fix a violation of this rule, initialize all static data when it is declared and remove the static constructor.
102	CA2208	Instantiate argument exceptions correctly	Usage	True	True	A call is made to the default (parameterless) constructor of an exception type that is or derives from ArgumentException, or an incorrect string argument is passed to a parameterized constructor of an exception type that is or derives from ArgumentException.
103	CA2211	Non-constant fields should not be visible	Usage	True	False	Static fields that are neither constants nor read-only are not thread-safe. Access to such a field must be carefully controlled and requires advanced programming techniques to synchronize access to the class object.
104	CA2213	Disposable fields should be disposed	Usage	True	False	A type that implements System.IDisposable declares fields that are of types that also implement IDisposable. The Dispose method of the field is not called by the Dispose method of the declaring type. To fix a violation of this rule, call Dispose on fields that are of types that implement IDisposable if you are responsible for allocating and releasing the unmanaged resources held by the field.
105	CA2214	Do not call overridable methods in constructors	Usage	True	False	Virtual methods defined on the class should not be called from constructors. If a derived class has overridden the method, the derived class version will be called (before the derived class constructor is called).
106	CA2216	Disposable types should declare finalizer	Usage	True	True	A type that implements System.IDisposable and has fields that suggest the use of unmanaged resources does not implement a finalizer, as described by Object.Finalize.
107	CA2217	Do not mark enums with FlagsAttribute	Usage	False	True	An externally visible enumeration is marked by using FlagsAttribute, and it has one or more values that are not powers of two or a combination of the other defined values on the enumeration.
108	CA2218	Override GetHashCode on overriding Equals	Usage	True	True	GetHashCode returns a value, based on the current instance, that is suited for hashing algorithms and data structures such as a hash table. Two objects that are the same type and are equal must return the same hash code.
109	CA2219	Do not raise exceptions in finally clauses	Usage	True	False	When an exception is raised in a finally clause, the new exception hides the active exception. This makes the original error difficult to detect and debug.
110	CA2224	Override Equals on overloading operator equals	Usage	True	True	A public type implements the equality operator but does not override Object.Equals.
111	CA2225	Operator overloads have named alternates	Usage	True	True	An operator overload was detected, and the expected named alternative method was not found. The named alternative member provides access to the same functionality as the operator and is provided for developers who program in languages that do not support overloaded operators.
112	CA2226	Operators should have symmetrical overloads	Usage	True	True	A type implements the equality or inequality operator and does not implement the opposite operator.
113	CA2227	Collection properties should be read only	Usage	True	False	A writable collection property allows a user to replace the collection with a different collection. A read-only property stops the collection from being replaced but still allows the individual members to be set.
114	CA2229	Implement serialization constructors	Usage	True	True	To fix a violation of this rule, implement the serialization constructor. For a sealed class, make the constructor private; otherwise, make it protected.
115	CA2231	Overload operator equals on overriding value type Equals	Usage	True	True	In most programming languages there is no default implementation of the equality operator (==) for value types. If your programming language supports operator overloads, you should consider implementing the equality operator. Its behavior should be identical to that of Equals
116	CA2234	Pass system uri objects instead of strings	Usage	True	False	A call is made to a method that has a string parameter whose name contains "uri", "URI", "urn", "URN", "url", or "URL". The declaring type of the method contains a corresponding method overload that has a System.Uri parameter.
117	CA2235	Mark all non-serializable fields	Usage	True	True	An instance field of a type that is not serializable is declared in a type that is serializable.
118	CA2237	Mark ISerializable types with serializable	Usage	True	True	To be recognized by the common language runtime as serializable, types must be marked by using the SerializableAttribute attribute even when the type uses a custom serialization routine through implementation of the ISerializable interface.
119	CA2241	Provide correct arguments to formatting methods	Usage	True	False	The format argument that is passed to System.String.Format does not contain a format item that corresponds to each object argument, or vice versa.
120	CA2242	Test for NaN correctly	Usage	True	True	This expression tests a value against Single.Nan or Double.Nan. Use Single.IsNan(Single) or Double.IsNan(Double) to test the value.
121	CA2243	Attribute string literals should parse correctly	Usage	True	False	The string literal parameter of an attribute does not parse correctly for a URL, a GUID, or a version.
122	CA2244	Do not duplicate indexed element initializations	Usage	True	False	Indexed elements in objects initializers must initialize unique elements. A duplicate index might overwrite a previous element initialization.
123	CA2245	Do not assign a property to itself.	Usage	True	False	The property {0} should not be assigned to itself.
124	CA2300	Do not use insecure deserializer BinaryFormatter	Security	False	False	The method '{0}' is insecure when deserializing untrusted data. If you need to instead detect BinaryFormatter deserialization without a SerializationBinder set, then disable rule CA2300, and enable rules CA2301 and CA2302.
125	CA2301	Do not call BinaryFormatter.Deserialize without first setting BinaryFormatter.Binder	Security	False	False	The method '{0}' is insecure when deserializing untrusted data without a SerializationBinder to restrict the type of objects in the deserialized object graph.
126	CA2302	Ensure BinaryFormatter.Binder is set before calling BinaryFormatter.Deserialize	Security	False	False	The method '{0}' is insecure when deserializing untrusted data without a SerializationBinder to restrict the type of objects in the deserialized object graph.
127	CA2305	Do not use insecure deserializer LosFormatter	Security	False	False	The method '{0}' is insecure when deserializing untrusted data.
128	CA2310	Do not use insecure deserializer NetDataContractSerializer	Security	False	False	The method '{0}' is insecure when deserializing untrusted data. If you need to instead detect NetDataContractSerializer deserialization without a SerializationBinder set, then disable rule CA2310, and enable rules CA2311 and CA2312.
129	CA2311	Do not deserialize without first setting NetDataContractSerializer.Binder	Security	False	False	The method '{0}' is insecure when deserializing untrusted data without a SerializationBinder to restrict the type of objects in the deserialized object graph.
130	CA2312	Ensure NetDataContractSerializer.Binder is set before deserializing	Security	False	False	The method '{0}' is insecure when deserializing untrusted data without a SerializationBinder to restrict the type of objects in the deserialized object graph.
131	CA2315	Do not use insecure deserializer ObjectStateFormatter	Security	False	False	The method '{0}' is insecure when deserializing untrusted data.
132	CA2321	Do not deserialize with JavaScriptSerializer using a SimpleTypeResolver	Security	False	False	The method '{0}' is insecure when deserializing untrusted data with a JavaScriptSerializer initialized with a SimpleTypeResolver. Initialize JavaScriptSerializer without a JavaScriptTypeResolver specified, or initialize with a JavaScriptTypeResolver that limits the types of objects in the deserialized object graph.
133	CA2322	Ensure JavaScriptSerializer is not initialized with SimpleTypeResolver before deserializing	Security	False	False	The method '{0}' is insecure when deserializing untrusted data with a JavaScriptSerializer initialized with a SimpleTypeResolver. Ensure that the JavaScriptSerializer is initialized without a JavaScriptTypeResolver specified, or initialized with a JavaScriptTypeResolver that limits the types of objects in the deserialized object graph.
134	CA2326	Do not use TypeNameHandling values other than None	Security	False	False	Deserializing JSON when using a TypeNameHandling value other than None can be insecure. If you need to instead detect Json.NET deserialization when a SerializationBinder isn't specified, then disable rule CA2326, and enable rules CA2327, CA2328, CA2329, and CA2330.
135	CA2327	Do not use insecure JsonSerializerSettings	Security	False	False	When deserializing untrusted input, allowing arbitrary types to be deserialized is insecure. When using JsonSerializerSettings, use TypeNameHandling.None, or for values other than None, restrict deserialized types with a SerializationBinder.
136	CA2328	Ensure that JsonSerializerSettings are secure	Security	False	False	When deserializing untrusted input, allowing arbitrary types to be deserialized is insecure. When using JsonSerializerSettings, ensure TypeNameHandling.None is specified, or for values other than None, ensure a SerializationBinder is specified to restrict deserialized types.
137	CA2329	Do not deserialize with JsonSerializer using an insecure configuration	Security	False	False	When deserializing untrusted input, allowing arbitrary types to be deserialized is insecure. When using deserializing JsonSerializer, use TypeNameHandling.None, or for values other than None, restrict deserialized types with a SerializationBinder.
138	CA2330	Ensure that JsonSerializer has a secure configuration when deserializing	Security	False	False	When deserializing untrusted input, allowing arbitrary types to be deserialized is insecure. When using deserializing JsonSerializer, use TypeNameHandling.None, or for values other than None, restrict deserialized types with a SerializationBinder.
139	CA3001	Review code for SQL injection vulnerabilities	Security	False	False	Potential SQL injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.
140	CA3002	Review code for XSS vulnerabilities	Security	False	False	Potential cross-site scripting (XSS) vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.
141	CA3003	Review code for file path injection vulnerabilities	Security	False	False	Potential file path injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.
142	CA3004	Review code for information disclosure vulnerabilities	Security	False	False	Potential information disclosure vulnerability was found where '{0}' in method '{1}' may contain unintended information from '{2}' in method '{3}'.
143	CA3005	Review code for LDAP injection vulnerabilities	Security	False	False	Potential LDAP injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.
144	CA3006	Review code for process command injection vulnerabilities	Security	False	False	Potential process command injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.
145	CA3007	Review code for open redirect vulnerabilities	Security	False	False	Potential open redirect vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.
146	CA3008	Review code for XPath injection vulnerabilities	Security	False	False	Potential XPath injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.
147	CA3009	Review code for XML injection vulnerabilities	Security	False	False	Potential XML injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.
148	CA3010	Review code for XAML injection vulnerabilities	Security	False	False	Potential XAML injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.
149	CA3011	Review code for DLL injection vulnerabilities	Security	False	False	Potential DLL injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.
150	CA3012	Review code for regex injection vulnerabilities	Security	False	False	Potential regex injection vulnerability was found where '{0}' in method '{1}' may be tainted by user-controlled data from '{2}' in method '{3}'.
151	CA3061	Do Not Add Schema By URL	Security	True	False	This overload of XmlSchemaCollection.Add method internally enables DTD processing on the XML reader instance used, and uses UrlResolver for resolving external XML entities. The outcome is information disclosure. Content from file system or network shares for the machine processing the XML can be exposed to attacker. In addition, an attacker can use this as a DoS vector.
152	CA3075	Insecure DTD processing in XML	Security	True	False	Using XmlTextReader.Load(), creating an insecure XmlReaderSettings instance when invoking XmlReader.Create(), setting the InnerXml property of the XmlDocument and enabling DTD processing using XmlUrlResolver insecurely can lead to information disclosure. Replace it with a call to the Load() method overload that takes an XmlReader instance, use XmlReader.Create() to accept XmlReaderSettings arguments or consider explicitly setting secure values. The DataViewSettingCollectionString property of DataViewManager should always be assigned from a trusted source, the DtdProcessing property should be set to false, and the XmlResolver property should be changed to XmlSecureResolver or null.
153	CA3076	Insecure XSLT script processing.	Security	True	False	Providing an insecure XsltSettings instance and an insecure XmlResolver instance to XslCompiledTransform.Load method is potentially unsafe as it allows processing script within XSL, which on an untrusted XSL input may lead to malicious code execution. Either replace the insecure XsltSettings argument with XsltSettings.Default or an instance that has disabled document function and script execution, or replace the XmlResolver argurment with null or an XmlSecureResolver instance. This message may be suppressed if the input is known to be from a trusted source and external resource resolution from locations that are not known in advance must be supported.
154	CA3077	Insecure Processing in API Design, XmlDocument and XmlTextReader	Security	True	False	Enabling DTD processing on all instances derived from XmlTextReader or  XmlDocument and using XmlUrlResolver for resolving external XML entities may lead to information disclosure. Ensure to set the XmlResolver property to null, create an instance of XmlSecureResolver when processing untrusted input, or use XmlReader.Create method with a secure XmlReaderSettings argument. Unless you need to enable it, ensure the DtdProcessing property is set to false.
155	CA3147	Mark Verb Handlers With Validate Antiforgery Token	Security	True	False	Missing ValidateAntiForgeryTokenAttribute on controller action {0}.
156	CA5350	Do Not Use Weak Cryptographic Algorithms	Security	True	False	Cryptographic algorithms degrade over time as attacks become for advances to attacker get access to more computation. Depending on the type and application of this cryptographic algorithm, further degradation of the cryptographic strength of it may allow attackers to read enciphered messages, tamper with enciphered  messages, forge digital signatures, tamper with hashed content, or otherwise compromise any cryptosystem based on this algorithm. Replace encryption uses with the AES algorithm (AES-256, AES-192 and AES-128 are acceptable) with a key length greater than or equal to 128 bits. Replace hashing uses with a hashing function in the SHA-2 family, such as SHA-2 512, SHA-2 384, or SHA-2 256.
157	CA5351	Do Not Use Broken Cryptographic Algorithms	Security	True	False	An attack making it computationally feasible to break this algorithm exists. This allows attackers to break the cryptographic guarantees it is designed to provide. Depending on the type and application of this cryptographic algorithm, this may allow attackers to read enciphered messages, tamper with enciphered  messages, forge digital signatures, tamper with hashed content, or otherwise compromise any cryptosystem based on this algorithm. Replace encryption uses with the AES algorithm (AES-256, AES-192 and AES-128 are acceptable) with a key length greater than or equal to 128 bits. Replace hashing uses with a hashing function in the SHA-2 family, such as SHA512, SHA384, or SHA256. Replace digital signature uses with RSA with a key length greater than or equal to 2048-bits, or ECDSA with a key length greater than or equal to 256 bits.
158	CA5358	Do Not Use Unsafe Cipher Modes	Security	False	False	These modes are vulnerable to attacks. Use only approved modes (CBC, CTS).
159	CA5359	Do Not Disable Certificate Validation	Security	True	False	A certificate can help authenticate the identity of the server. Clients should validate the server certificate to ensure requests are sent to the intended server. If the ServerCertificateValidationCallback always returns 'true', any certificate will pass validation.
160	CA5360	Do Not Call Dangerous Methods In Deserialization	Security	True	False	Insecure Deserialization is a vulnerability which occurs when untrusted data is used to abuse the logic of an application, inflict a Denial-of-Service (DoS) attack, or even execute arbitrary code upon it being deserialized. It’s frequently possible for malicious users to abuse these deserialization features when the application is deserializing untrusted data which is under their control. Specifically, invoke dangerous methods in the process of deserialization. Successful insecure deserialization attacks could allow an attacker to carry out attacks such as DoS attacks, authentication bypasses, and remote code execution.
161	CA5361	Do Not Disable SChannel Use of Strong Crypto	Security	True	False	Starting with the .NET Framework 4.6, the System.Net.ServicePointManager and System.Net.Security.SslStream classes are recommeded to use new protocols. The old ones have protocol weaknesses and are not supported. Setting Switch.System.Net.DontEnableSchUseStrongCrypto with true will use the old weak crypto check and opt out of the protocol migration.
162	CA5362	Do Not Refer Self In Serializable Class	Security	False	False	This can allow an attacker to DOS or exhaust the memory of the process.
163	CA5363	Do Not Disable Request Validation	Security	True	False	Request validation is a feature in ASP.NET that examines HTTP requests and determines whether they contain potentially dangerous content. This check adds protection from markup or code in the URL query string, cookies, or posted form values that might have been added for malicious purposes. So, it is generally desirable and should be left enabled for defense in depth.
164	CA5364	Do Not Use Deprecated Security Protocols	Security	True	False	Using a deprecated security protocol rather than the system default is risky.
165	CA5365	Do Not Disable HTTP Header Checking	Security	True	False	HTTP header checking enables encoding of the carriage return and newline characters, \r and \n, that are found in response headers. This encoding can help to avoid injection attacks that exploit an application that echoes untrusted data contained by the header.
166	CA5366	Use XmlReader For DataSet Read Xml	Security	True	False	Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.
167	CA5367	Do Not Serialize Types With Pointer Fields	Security	False	False	Pointers are not "type safe" in the sense that you cannot guarantee the correctness of the memory they point at. So, serializing types with pointer fields is dangerous, as it may allow an attacker to control the pointer.
168	CA5368	Set ViewStateUserKey For Classes Derived From Page	Security	True	False	Setting the ViewStateUserKey property can help you prevent attacks on your application by allowing you to assign an identifier to the view-state variable for individual users so that they cannot use the variable to generate an attack. Otherwise, there will be cross-site request forgery vulnerabilities.
169	CA5369	Use XmlReader For Deserialize	Security	True	False	Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.
170	CA5370	Use XmlReader For Validating Reader	Security	True	False	Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.
171	CA5371	Use XmlReader For Schema Read	Security	True	False	Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.
172	CA5372	Use XmlReader For XPathDocument	Security	True	False	Processing XML from untrusted data may load dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD processing disabled.
173	CA5373	Do not use obsolete key derivation function	Security	True	False	Password-based key derivation should use PBKDF2 with SHA-2. Avoid using PasswordDeriveBytes since it generates a PBKDF1 key. Avoid using Rfc2898DeriveBytes.CryptDeriveKey since it doesn't use the iteration count or salt.
174	CA5374	Do Not Use XslTransform	Security	True	False	Do not use XslTransform. It does not restrict potentially dangerous external references.
175	CA5375	Do Not Use Account Shared Access Signature	Security	False	False	Shared Access Signatures(SAS) are a vital part of the security model for any application using Azure Storage, they should provide limited and safe permissions to your storage account to clients that don't have the account key. All of the operations available via a service SAS are also available via an account SAS, that is, account SAS is too powerful. So it is recommended to use Service SAS to delegate access more carefully.
176	CA5376	Use SharedAccessProtocol HttpsOnly	Security	True	False	HTTPS encrypts network traffic. Use HttpsOnly, rather than HttpOrHttps, to ensure network traffic is always encrypted to help prevent disclosure of sensitive data.
177	CA5377	Use Container Level Access Policy	Security	True	False	No access policy identifier is specified, making tokens non-revocable.
178	CA5378	Do not disable ServicePointManagerSecurityProtocols	Security	True	False	Do not set Switch.System.ServiceModel.DisableUsingServicePointManagerSecurityProtocols to true. Setting this switch limits Windows Communication Framework (WCF) to using Transport Layer Security (TLS) 1.0, which is insecure and obsolete.
179	CA5379	Do Not Use Weak Key Derivation Function Algorithm	Security	True	False	Some implementations of the Rfc2898DeriveBytes class allow for a hash algorithm to be specified in a constructor parameter or overwritten in the HashAlgorithm property. If a hash algorithm is specified, then it should be SHA-256 or higher.
180	CA5380	Do Not Add Certificates To Root Store	Security	True	False	By default, the Trusted Root Certification Authorities certificate store is configured with a set of public CAs that has met the requirements of the Microsoft Root Certificate Program. Since all trusted root CAs can issue certificates for any domain, an attacker can pick a weak or coercible CA that you install by yourself to target for an attack – and a single vulnerable, malicious or coercible CA undermines the security of the entire system. To make matters worse, these attacks can go unnoticed quite easily.
181	CA5381	Ensure Certificates Are Not Added To Root Store	Security	True	False	By default, the Trusted Root Certification Authorities certificate store is configured with a set of public CAs that has met the requirements of the Microsoft Root Certificate Program. Since all trusted root CAs can issue certificates for any domain, an attacker can pick a weak or coercible CA that you install by yourself to target for an attack – and a single vulnerable, malicious or coercible CA undermines the security of the entire system. To make matters worse, these attacks can go unnoticed quite easily.
182	CA5382	Use Secure Cookies In ASP.Net Core	Security	False	False	Applications available over HTTPS must use secure cookies.
183	CA5383	Ensure Use Secure Cookies In ASP.Net Core	Security	False	False	Applications available over HTTPS must use secure cookies.
184	CA5384	Do Not Use Digital Signature Algorithm (DSA)	Security	True	False	DSA is too weak to use.
185	CA5385	Use Rivest–Shamir–Adleman (RSA) Algorithm With Sufficient Key Size	Security	True	False	Encryption algorithms are vulnerable to brute force attacks when too small a key size is used.
186	CA5386	Avoid hardcoding SecurityProtocolType value	Security	False	False	Avoid hardcoding SecurityProtocolType {0}, and instead use SecurityProtocolType.SystemDefault to allow the operating system to choose the best Transport Layer Security protocol to use.
187	CA5387	Do Not Use Weak Key Derivation Function With Insufficient Iteration Count	Security	False	False	When deriving cryptographic keys from user-provided inputs such as password, use sufficient iteration count (at least 100k).
188	CA5388	Ensure Sufficient Iteration Count When Using Weak Key Derivation Function	Security	False	False	When deriving cryptographic keys from user-provided inputs such as password, use sufficient iteration count (at least 100k).
189	CA5389	Do Not Add Archive Item's Path To The Target File System Path	Security	True	False	When extracting files from an archive and using the archive item's path, check if the path is safe. Archive path can be relative and can lead to file system access outside of the expected file system target path, leading to malicious config changes and remote code execution via lay-and-wait technique.
190	CA5390	Do Not Hard Code Encryption Key	Security	True	False	SymmetricAlgorithm's .Key property, or a method's rgbKey parameter, should never be a hardcoded value.
191	CA5391	Use antiforgery tokens in ASP.NET Core MVC controllers	Security	True	False	Handling a POST, PUT, PATCH, or DELETE request without validating an antiforgery token may be vulnerable to cross-site request forgery attacks. A cross-site request forgery attack can send malicious requests from an authenticated user to your ASP.NET Core MVC controller.
192	CA5392	Use DefaultDllImportSearchPaths attribute for P/Invokes	Security	True	False	By default, P/Invokes using DllImportAttribute probe a number of directories, including the current working directory for the library to load. This can be a security issue for certain applications, leading to DLL hijacking.
193	CA5393	Do not use unsafe DllImportSearchPath value	Security	True	False	There could be a malicious DLL in the default DLL search directories. Or, depending on where your application is run from, there could be a malicious DLL in the application's directory. Use a DllImportSearchPath value that specifies an explicit search path instead. The DllImportSearchPath flags that this rule looks for can be configured in .editorconfig.
194	CA5394	Do not use insecure randomness	Security	False	False	{0} is an insecure random number generator. Use cryptographically secure random number generators when randomness is required for security
195	CA5395	Miss HttpVerb attribute for action methods	Security	False	False	All the methods that create, edit, delete, or otherwise modify data do so in the [HttpPost] overload of the method, which needs to be protected with the anti forgery attribute from request forgery. Performing a GET operation should be a safe operation that has no side effects and doesn't modify your persisted data.
196	CA5396	Set HttpOnly to true for HttpCookie	Security	False	False	As a defense in depth measure, ensure security sensitive HTTP cookies are marked as HttpOnly. This indicates web browsers should disallow scripts from accessing the cookies. Injected malicious scripts are a common way of stealing cookies.
197	CA5397	Do not use deprecated SslProtocols values	Security	True	False	Older protocol versions of Transport Layer Security (TLS) are less secure than TLS 1.2 and TLS 1.3, and are more likely to have new vulnerabilities. Avoid older protocol versions to minimize risk.
198	CA5398	Avoid hardcoded SslProtocols values	Security	False	False	Current Transport Layer Security protocol versions may become deprecated if vulnerabilities are found. Avoid hardcoding SslProtocols values to keep your application secure. Use 'None' to let the Operating System choose a version.
199	CA9999	Analyzer version mismatch	Reliability	True	False	Analyzers in this package require a certain minimum version of Microsoft.CodeAnalysis to execute correctly. Refer to https://docs.microsoft.com/visualstudio/code-quality/install-fxcop-analyzers#fxcopanalyzers-package-versions to install the correct analyzer version.