Automated SQL parameterization with Dapper
Default encoding strings in views with Razor
Requiring cross site request forgery (XSRF) tokens for non-idempotent (ie. POST, PUT, DELETE, etc.) routes by default
HMACs with default expirations and common validation code
Adopting TypeScript—an ongoing process—which increases our confidence around shipping correct JavaScript
Private data—for Teams and Enterprise— is on separate infrastructure with separate access controls
SQL injection attacks [2017 #1]
XML external entity (XEE) attacks [2017 #4] …