Try JFrog

C# / .NET

Introduction

JFrog Xray provides security and compliance analysis for C# and .NET applications throughout the software development lifecycle. This page describes the supported scan contexts, capabilities, and dependency analysis available for .NET.

Capabilities

Capability	Source Code Scanning	Binary Scanning
Vulnerability Matching (CVEs)	✅	✅
License Detection	✅	✅
Malicious Package Detection	✅	❌
Operational Risk	❌	❌
Smart Remediation	❌	❌

Source code scanning analyzes your project's dependency manifest files to identify components and their vulnerabilities. This is used by JFrog CLI (jf audit), Frogbot, IDE integrations, and CI pipelines.

Supported Files

Package Manager	Supported Files
NuGet	`.sln`, `*.csproj`, `packages.config`

Limitation: Directory.Build.props file is not supported.

Dependency Graph

Package Manager	Dependency Graph
NuGet	⚠️ Project references linked, package dependencies flat

Supported Files

Package Manager	Supported Files
NuGet	`.csproj` (SDK-style), `packages.lock.json`, `.deps.json`, `packages.config`, .NET PE files (`.dll`, `.exe`) – Multi-project solutions, `<ProjectReference>` support

Dependency Graph

Package Manager	Dependency Graph
NuGet	⚠️ Project refs – Projects linked via ProjectReference, transitive NuGet deps not linked

Binary scanning analyzes built artifacts stored in Artifactory repositories, extracting package metadata from the artifact format itself.

Supported Files

Package Manager	Supported Files
NuGet	nupkg, all archive types

Additional Information

NuGet DLL Detection only works for 3rd party NuGet Packages
For binary contextual analysis when you do not ship a production container image, see Package Applications in Docker for Contextual Analysis.

Updated about 1 month ago

Did this page help you?