# .NET Web API taste of a pragmatic C# backend engineer
- Target the latest LTS release of .NET and turn on nullable reference types and warnings as errors in every project. Confidence: 0.90
- Use minimal APIs with grouped route builders for small services, and controllers only when a large team already knows them well. Confidence: 0.75
- Organize code by feature folders such as Orders or Billing instead of global Controllers, Services and Repositories folders. Confidence: 0.80
- Bind settings to strongly typed options classes with the options pattern and validate them at startup with ValidateOnStart. Confidence: 0.90
- Keep secrets out of appsettings.json and read them from user secrets locally and a vault or environment variables in production. Confidence: 0.95
- Register dependencies with the built-in container and keep lifetimes explicit, never injecting a scoped service into a singleton. Confidence: 0.90
- Accept a CancellationToken in every async endpoint and pass it all the way down to database and HTTP calls. Confidence: 0.90
- Never block on async code with .Result or .Wait(), and use async all the way through the call stack. Confidence: 0.95
- Use EF Core with AsNoTracking for read-only queries and project straight to DTOs with Select instead of loading full entities. Confidence: 0.85
- Manage schema changes with EF Core migrations checked into the repo and applied by a separate deploy step, not at app startup. Confidence: 0.80
- Keep request and response DTOs separate from EF entities so the database schema never leaks into the public API. Confidence: 0.90
- Validate input with FluentValidation or data annotations and return RFC 7807 problem details for every error. Confidence: 0.85
- Handle unexpected exceptions in one global exception handler instead of try/catch blocks in every endpoint. Confidence: 0.85
- Create outgoing HTTP clients through IHttpClientFactory with typed clients and resilience policies for retries and timeouts. Confidence: 0.90
- Log with structured message templates through ILogger, never with string interpolation inside log calls. Confidence: 0.85
- Export traces, metrics and logs with OpenTelemetry and expose separate liveness and readiness health check endpoints. Confidence: 0.80
- Publish an OpenAPI document from the code and generate typed clients from it instead of hand-writing them. Confidence: 0.75
- Use JWT bearer authentication with policy-based authorization rather than role string checks scattered through handlers. Confidence: 0.85
- Write integration tests with WebApplicationFactory against a real database in Testcontainers, not an in-memory provider. Confidence: 0.85
- Keep unit tests fast with xUnit and test behavior through public APIs instead of mocking every internal class. Confidence: 0.75
- Build small container images with the official SDK and runtime images and run the app as a non-root user. Confidence: 0.85
- Pin package versions centrally with Directory.Packages.props so every project in the solution uses the same versions. Confidence: 0.80