> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Launch a Scan on a .NET Project

> Use lockfiles like packages.lock.json in your .NET build for better SCA detection with CybeDefend.

**.NET** projects often rely on NuGet packages. By generating a `packages.lock.json` file, you create a stable snapshot of all dependencies—critical for accurate CybeDefend SCA scanning.

## Recommended Steps

1. **Enable Lockfiles in .csproj**

   You can enable lockfiles in any of these ways:

   **Option A**: Add to your `.csproj` file:

   ```xml theme={null}
   <Project Sdk="Microsoft.NET.Sdk">
     <PropertyGroup>
       <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
       <RestoreLockedMode Condition="'$(ContinuousIntegrationBuild)' == 'true'">true</RestoreLockedMode>
     </PropertyGroup>
   </Project>
   ```

   **Option B**: For all projects, create a `Directory.Build.props` file in your solution root:

   ```xml theme={null}
   <Project>
     <PropertyGroup>
       <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
     </PropertyGroup>
   </Project>
   ```

2. **Run dotnet restore**\
   This generates a `packages.lock.json` file for each project.
   ```bash theme={null}
   dotnet restore --use-lock-file
   ```

3. **Commit packages.lock.json**\
   Never edit this file manually. Let `dotnet restore` handle updates.

## Why You Should Use Lockfiles

Using a **lockfile** is critical for secure and predictable builds. A lockfile contains a **fixed version** and a **hash** for each dependency and sub-dependency in your project.

1. **Supply Chain Protection**\
   Lockfiles prevent malicious package injections. This is crucial as supply chain attacks are rising.
2. **Predictable Builds**\
   Everyone uses the exact same package versions, avoiding “it works on my machine” inconsistencies.
3. **Performance Gains**\
   With dependency versions locked, build tools skip the usual resolution step, making builds faster.

<Note>
  Lockfiles are never edited manually. They’re generated and updated by your package manager and committed to your repository, ensuring consistent environments for all teammates.
</Note>

## Lockfile Commands

* **Generate**: `dotnet restore --use-lock-file`
* **Locked Restore**: `dotnet restore --locked-mode`
* **Update**: Change versions in `.csproj` or `Directory.Packages.props`, then run `dotnet restore --force` to update the lockfile.

## Using Central Package Management

For larger solutions with many projects, use NuGet's Central Package Management:

1. Create a `Directory.Packages.props` file in your solution root:
   ```xml theme={null}
   <Project>
     <PropertyGroup>
       <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
     </PropertyGroup>
     <ItemGroup>
       <!-- Define all package versions centrally -->
       <PackageVersion Include="Newtonsoft.Json" Version="13.0.1" />
     </ItemGroup>
   </Project>
   ```

2. In your project files, reference packages without versions:
   ```xml theme={null}
   <ItemGroup>
     <PackageReference Include="Newtonsoft.Json" />
   </ItemGroup>
   ```

## Supported Files for .NET

| File Examples                                                             |
| ------------------------------------------------------------------------- |
| `.deps.json`, `packages.lock.json`, `Directory.Packages.props`, `.csproj` |

<Note>
  If your lockfile is missing, SCA scanning might only detect partial or incorrect versions of NuGet packages. Lockfiles ensure precise dependency resolution.
</Note>

<Tip>
  Use <strong>Directory.Packages.props</strong> (NuGet central package management) for an even cleaner approach to pinned versions across multiple projects.
</Tip>