Directory.Build.props

<Project>

  <PropertyGroup>
    <!--
      Run analyzers on every build (CI + local). AnalysisMode is left at the
      SDK default ("Default") so only Microsoft's curated set of rules is on;
      .editorconfig then promotes the entire Security category to error.
      Setting AllEnabledByDefault here would resurrect ~1200 design/style
      warnings that aren't actionable for this project and would drown out
      the actual security signal.
    -->
    <RunAnalyzersDuringBuild>true</RunAnalyzersDuringBuild>
    <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
    <AnalysisLevel>latest</AnalysisLevel>
  </PropertyGroup>

  <ItemGroup>
    <!--
      SecurityCodeScan: free OWASP-style Roslyn analyzer covering injection,
      crypto misuse, weak randomness, XML/XPath/LDAP injection, etc.
      PrivateAssets=all keeps it as a build-time analyzer only — nothing ships.
    -->
    <PackageReference Include="SecurityCodeScan.VS2019" Version="5.6.7">
      <PrivateAssets>all</PrivateAssets>
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    </PackageReference>
  </ItemGroup>

</Project>