anchor.diff:  CA909,UseFrameworksThatSatisfySecurityRequirements,System.Runtime,#N/A,#N/A,#N/A,No,,,,,,,Cut,Deprecated rule checking for insecure/beta framework use,
   RS0001,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Use SpecializedCollections.EmptyEnumerable(),#N/A,,,,,,Performance,,Ported,,
   RS0002,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Use SpecializedCollections.SingletonEnumerable(),#N/A,,,,,,Performance,,Ported,,
  -RS0003,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Do not directly await a Task,#N/A,,,,,,Reliability,,Ported,,
  +RS0003,#N/A,System.Threading.Tasks,Roslyn.Diagnostics.Analyzers,Do not directly await a Task,#N/A,,,,,,Reliability,,Ported,,
   RS0004,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Invoke the correct property to ensure correct use site diagnostics.,#N/A,,,,,,Usage,,Ported,,
   RS0005,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Do not use generic CodeAction.Create to create CodeAction,#N/A,,,,,,Performance,,Ported,,
  -RS0006,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Do not mix attributes from different versions of MEF,#N/A,,,,,,Reliability,,Ported,,
  -RS0007,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Avoid zero-length array allocations.,#N/A,,,,,,Performance,,Ported,,
  -RS0008,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Implement IEquatable when overriding Object.Equals,#N/A,,,,,,Performance,,Ported,,
  -RS0009,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Override Object.Equals(object) when implementing Iequatable,#N/A,,,,,,Reliability,,Ported,,
  -RS0010,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Avoid using cref tags with a prefix,"Use of cref tags with prefixes should be avoided, since it prevents the compiler from verifying references and the IDE from updating references during refactorings. It is permissible to suppress this error at a single documentation site if the cref must use a prefix because the type being mentioned is not findable by the compiler. For example, if a cref is mentioning a special attribute in the full framework but you're in a file that compiles against the portable framework, or if you want to reference a type at higher layer of Roslyn, you should suppress the error. You should not suppress the error just because you want to take a shortcut and avoid using the full syntax.",,,,,,Documentation,,Ported,,
  -RS0011,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,CancellationToken parameters must come last,#N/A,,,,,,ApiDesign,,Ported,,
  -RS0012,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Do not call ToImmutableArray on an ImmutableArray value,#N/A,,,,,,Reliability,,Ported,,
  +RS0006,#N/A,Microsoft.Composition,Roslyn.Diagnostics.Analyzers,Do not mix attributes from different versions of MEF,#N/A,,,,,,Reliability,,Ported,,
  +RS0007,#N/A,Roslyn.Diagnostics,Roslyn.Diagnostics.Analyzers,Avoid zero-length array allocations.,#N/A,,,,,,Performance,,Ported,,
  +RS0008,#N/A,Microsoft.ApiDesignGuidelines,Roslyn.Diagnostics.Analyzers,Implement IEquatable when overriding Object.Equals,#N/A,,,,,,Performance,,Ported,,
  +RS0009,#N/A,Roslyn.Diagnostics,Roslyn.Diagnostics.Analyzers,Override Object.Equals(object) when implementing Iequatable,#N/A,,,,,,Reliability,,Ported,,
  +RS0010,#N/A,XmlDocumentationComments,Roslyn.Diagnostics.Analyzers,Avoid using cref tags with a prefix,"Use of cref tags with prefixes should be avoided, since it prevents the compiler from verifying references and the IDE from updating references during refactorings. It is permissible to suppress this error at a single documentation site if the cref must use a prefix because the type being mentioned is not findable by the compiler. For example, if a cref is mentioning a special attribute in the full framework but you're in a file that compiles against the portable framework, or if you want to reference a type at higher layer of Roslyn, you should suppress the error. You should not suppress the error just because you want to take a shortcut and avoid using the full syntax.",,,,,,Documentation,,Ported,,
  +RS0011,#N/A,Microsoft.ApiDesignGuidelines,Roslyn.Diagnostics.Analyzers,CancellationToken parameters must come last,#N/A,,,,,,ApiDesign,,Ported,,
  +RS0012,#N/A,System.Collections.Immutable,Roslyn.Diagnostics.Analyzers,Do not call ToImmutableArray on an ImmutableArray value,#N/A,,,,,,Reliability,,Ported,,
   RS0013,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Do not invoke Diagnostic.Descriptor,"Accessing the Descriptor property of Diagnostic in compiler layer leads to unnecessary string allocations for fields of the descriptor that are not utilized in command line compilation. Hence, you should avoid accessing the Descriptor of the compiler diagnostics here. Instead you should directly access these properties off the Diagnostic type.",,,,,,Performance,,Ported,,
  -RS0014,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Do not use Enumerable methods on indexable collections. Instead use the collection directly,This collection is directly indexable. Going through LINQ here causes unnecessary allocations and CPU work.,,,,,,Performance,,Ported,,
  -RS0015,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Always consume the value returned by methods marked with PreserveSigAttribute,"PreserveSigAttribute indicates that a method will return an HRESULT, rather than throwing an exception. Therefore, it is important to consume the HRESULT returned by the method, so that errors can be detected. Generally, this is done by calling Marshal.ThrowExceptionForHR.",,,,,,Reliability,,Ported,,
  +RS0014,#N/A,System.Runtime,Roslyn.Diagnostics.Analyzers,Do not use Enumerable methods on indexable collections. Instead use the collection directly,This collection is directly indexable. Going through LINQ here causes unnecessary allocations and CPU work.,,,,,,Performance,,Ported,,
  +RS0015,#N/A,System.Runtime.InteropServices,Roslyn.Diagnostics.Analyzers,Always consume the value returned by methods marked with PreserveSigAttribute,"PreserveSigAttribute indicates that a method will return an HRESULT, rather than throwing an exception. Therefore, it is important to consume the HRESULT returned by the method, so that errors can be detected. Generally, this is done by calling Marshal.ThrowExceptionForHR.",,,,,,Reliability,,Ported,,
   RS0016,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Add public types and members to the declared API,"All public types and members should be declared in PublicAPI.txt. This draws attention to API changes in the code reviews and source control history, and helps prevent breaking changes.",,,,,,ApiDesign,,Ported,,
   RS0017,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,Remove deleted types and members from the declared API,"When removing a public type or member the corresponding entry in PublicAPI.txt should also be removed. This draws attention to API changes in the code reviews and source control history, and helps prevent breaking changes.",,,,,,ApiDesign,,Ported,,
  -RS0018,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Do not create tasks without passing a TaskScheduler,"Do not create tasks unless you are using one of the overloads that takes a TaskScheduler. The default is to schedule on TaskScheduler.Current, which would lead to deadlocks. Either use TaskScheduler.Default to schedule on the thread pool, or explicitly pass TaskScheduler.Current to make your intentions clear.",,,,,,Reliability,,Ported,,
  +RS0018,#N/A,System.Threading.Tasks,Roslyn.Diagnostics.Analyzers,Do not create tasks without passing a TaskScheduler,"Do not create tasks unless you are using one of the overloads that takes a TaskScheduler. The default is to schedule on TaskScheduler.Current, which would lead to deadlocks. Either use TaskScheduler.Default to schedule on the thread pool, or explicitly pass TaskScheduler.Current to make your intentions clear.",,,,,,Reliability,,Ported,,
   RS0019,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,SymbolDeclaredEvent must be generated for source symbols,"Compilation event queue is required to generate symbol declared events for all declared source symbols. Hence, every source symbol type or one of it's base types must generate a symbol declared event.",,,,,,Reliability,,Ported,,
  -RS0020,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,unused code,#N/A,,,,,,Maintainability,,Ported,,
  -RS0021,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Hidden (used by CodeFix),#N/A,,,,,,#N/A,,Ported,,
  -RS0022,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Constructor make noninheritable base class inheritable,"When a base class is noninheritable because its constructor is internal, a derived class should not make it inheritable by having a public or protected constructor.",,,,,,ApiDesign,,Ported,,
  -RS0023,#N/A,NotCategorized,Roslyn.Diagnostics.Analyzers,Parts exported with MEFv2 must be marked as Shared,#N/A,,,,,,Reliability,,Ported,,
  +RS0020,#N/A,FixMe,Roslyn.Diagnostics.Analyzers,unused code,#N/A,,,,,,Maintainability,,Ported,,
  +RS0021,#N/A,FixMe,Roslyn.Diagnostics.Analyzers,Hidden (used by CodeFix),#N/A,,,,,,#N/A,,Ported,,
  +RS0022,#N/A,Microsoft.ApiDesignGuidelines,Roslyn.Diagnostics.Analyzers,Constructor make noninheritable base class inheritable,"When a base class is noninheritable because its constructor is internal, a derived class should not make it inheritable by having a public or protected constructor.",,,,,,ApiDesign,,Ported,,
  +RS0023,#N/A,Microsoft.Composition,Roslyn.Diagnostics.Analyzers,Parts exported with MEFv2 must be marked as Shared,#N/A,,,,,,Reliability,,Ported,,
   RS0024,#N/A,Roslyn.Diagnostics.Analyzers,Roslyn.Diagnostics.Analyzers,The contents of the public API files are invalid,#N/A,,,,,,ApiDesign,,Ported,,
  -RS1001,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Missing diagnostic analyzer attribute,"Non-abstract sub-types of DiagnosticAnalyzer should be marked with DiagnosticAnalyzerAttribute(s). The argument to this attribute(s), if any, determine the supported languages for the analyzer. Analyzer types without this attribute will be ignored by the analysis engine.",,,,,,AnalyzerCorrectness,,,,
  -RS1002,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Missing kind argument while registering an analyzer action,"You must specify at least one syntax/symbol kinds of interest while registering a syntax/symbol analyzer action. Otherwise, the registered action will be dead code and will never be invoked during analysis.",,,,,,AnalyzerCorrectness,,,,
  -RS1003,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Unsupported SymbolKind argument while registering a symbol analyzer action,#N/A,,,,,,AnalyzerCorrectness,,,,
  -RS1004,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Recommend adding language support to diagnostic analyzer,"Diagnostic analyzer is marked as supporting only one language, but the analyzer assembly doesn't seem to refer to any language specific CodeAnalysis assemblies, and so is likely to work for more than one language. Consider adding an additional language argument to DiagnosticAnalyzerAttribute.",,,,,,AnalyzerCorrectness,,,,
  -RS1005,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,ReportDiagnostic invoked with an unsupported DiagnosticDescriptor,"ReportDiagnostic should only be invoked with supported DiagnosticDescriptors that are returned from DiagnosticAnalyzer.SupportedDiagnostics property. Otherwise, the reported diagnostic will be filtered out by the analysis engine.",,,,,,AnalyzerCorrectness,,,,
  -RS1006,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Invalid type argument for DiagnosticAnalyzer's Register method,"DiagnosticAnalyzer's language-specific Register methods, such as RegisterSyntaxNodeAction, RegisterCodeBlockStartAction and RegisterCodeBlockEndAction, expect a language-specific 'SyntaxKind' type argument for it's 'TLanguageKindEnumName' type parameter. Otherwise, the registered analyzer action can never be invoked during analysis.",,,,,,AnalyzerCorrectness,,,,
  -RS1007,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Provide localizable arguments to diagnostic descriptor constructor,"If your diagnostic analyzer and it's reported diagnostics need to be localizable, then the supported DiagnosticDescriptors used for constructing the diagnostics must also be localizable. If so, then localizable argument(s) must be provided for parameter 'title' (and optionally 'description') to the diagnostic descriptor constructor to ensure that the descriptor is localizable.",,,,,,AnalyzerLocalization,,,,
  -RS1008,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Avoid storing per-compilation data into the fields of a diagnostic analyzer,"Instance of a diagnostic analyzer might outlive the lifetime of compilation. Hence, storing per-compilation data, such as symbols, into the fields of a diagnostic analyzer might cause stale compilations to stay alive and cause memory leaks. Instead, you should store this data on a separate type instantiated in a compilation start action, registered using 'AnalysisContext.RegisterCompilationStartAction' API. An instance of this type will be created per-compilation and it won't outlive compilation's lifetime, hence avoiding memory leaks.",,,,,,AnalyzerPerformance,,,,
  -RS1009,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Only internal implementations of this interface are allowed,The author of this interface did not intend to have third party implementations of this interface and reserves the right to change it. Implementing this interface could therefore result in a source or binary compatibility issue with a future version of this interface.,,,,,,Compatibility,,,,
  -RS1010,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Create code actions should have a unique EquivalenceKey for FixAll occurrences support,"A CodeFixProvider that intends to support fix all occurrences must classify the registered code actions into equivalence classes by assigning it an explicit, non-null equivalence key which is unique across all registered code actions by this fixer. This enables the FixAllProvider to fix all diagnostics in the required scope by applying code actions from this fixer that are in the equivalence class of the trigger code action.",,,,,,Correctness,,,,
  -RS1011,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Use code actions that have a unique EquivalenceKey for FixAll occurrences support,"A CodeFixProvider that intends to support fix all occurrences must classify the registered code actions into equivalence classes by assigning it an explicit, non-null equivalence key which is unique across all registered code actions by this fixer. This enables the FixAllProvider to fix all diagnostics in the required scope by applying code actions from this fixer that are in the equivalence class of the trigger code action.",,,,,,Correctness,,,,
  -RS1012,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Start action has no registered actions,"An analyzer start action enables performing stateful analysis over a given code unit, such as a code block, compilation, etc. Careful design is necessary to achieve efficient analyzer execution without memory leaks. Use the following guidelines for writing such analyzers: 1. Define a new scope for the registered start action, possibly with a private nested type for analyzing each code unit. 2. If required, define and initialize state in the start action. 3. Register at least one non-end action that refers to this state in the start action. If no such action is necessary, consider replacing the start action with a non-start action. For example, a CodeBlockStartAction with no registered actions or only a registered CodeBlockEndAction should be replaced with a CodeBlockAction. 4. If required, register an end action to report diagnostics based on the final state.",,,,,,AnalyzerPerformance,,,,
  -RS1013,#N/A,Microsoft.CodeAnalysis.Analyzers,Microsoft.CodeAnalysis.Analyzers,Start action has no registered non-end actions,"An analyzer start action enables performing stateful analysis over a given code unit, such as a code block, compilation, etc. Careful design is necessary to achieve efficient analyzer execution without memory leaks. Use the following guidelines for writing such analyzers: 1. Define a new scope for the registered start action, possibly with a private nested type for analyzing each code unit. 2. If required, define and initialize state in the start action. 3. Register at least one non-end action that refers to this state in the start action. If no such action is necessary, consider replacing the start action with a non-start action. For example, a CodeBlockStartAction with no registered actions or only a registered CodeBlockEndAction should be replaced with a CodeBlockAction. 4. If required, register an end action to report diagnostics based on the final state.",,,,,,AnalyzerPerformance,,,,
  +RS1001,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Missing diagnostic analyzer attribute,"Non-abstract sub-types of DiagnosticAnalyzer should be marked with DiagnosticAnalyzerAttribute(s). The argument to this attribute(s), if any, determine the supported languages for the analyzer. Analyzer types without this attribute will be ignored by the analysis engine.",,,,,,AnalyzerCorrectness,,,,
  +RS1002,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Missing kind argument while registering an analyzer action,"You must specify at least one syntax/symbol kinds of interest while registering a syntax/symbol analyzer action. Otherwise, the registered action will be dead code and will never be invoked during analysis.",,,,,,AnalyzerCorrectness,,,,
  +RS1003,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Unsupported SymbolKind argument while registering a symbol analyzer action,#N/A,,,,,,AnalyzerCorrectness,,,,
  +RS1004,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Recommend adding language support to diagnostic analyzer,"Diagnostic analyzer is marked as supporting only one language, but the analyzer assembly doesn't seem to refer to any language specific CodeAnalysis assemblies, and so is likely to work for more than one language. Consider adding an additional language argument to DiagnosticAnalyzerAttribute.",,,,,,AnalyzerCorrectness,,,,
  +RS1005,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,ReportDiagnostic invoked with an unsupported DiagnosticDescriptor,"ReportDiagnostic should only be invoked with supported DiagnosticDescriptors that are returned from DiagnosticAnalyzer.SupportedDiagnostics property. Otherwise, the reported diagnostic will be filtered out by the analysis engine.",,,,,,AnalyzerCorrectness,,,,
  +RS1006,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Invalid type argument for DiagnosticAnalyzer's Register method,"DiagnosticAnalyzer's language-specific Register methods, such as RegisterSyntaxNodeAction, RegisterCodeBlockStartAction and RegisterCodeBlockEndAction, expect a language-specific 'SyntaxKind' type argument for it's 'TLanguageKindEnumName' type parameter. Otherwise, the registered analyzer action can never be invoked during analysis.",,,,,,AnalyzerCorrectness,,,,
  +RS1007,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Provide localizable arguments to diagnostic descriptor constructor,"If your diagnostic analyzer and it's reported diagnostics need to be localizable, then the supported DiagnosticDescriptors used for constructing the diagnostics must also be localizable. If so, then localizable argument(s) must be provided for parameter 'title' (and optionally 'description') to the diagnostic descriptor constructor to ensure that the descriptor is localizable.",,,,,,AnalyzerLocalization,,,,
  +RS1008,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Avoid storing per-compilation data into the fields of a diagnostic analyzer,"Instance of a diagnostic analyzer might outlive the lifetime of compilation. Hence, storing per-compilation data, such as symbols, into the fields of a diagnostic analyzer might cause stale compilations to stay alive and cause memory leaks. Instead, you should store this data on a separate type instantiated in a compilation start action, registered using 'AnalysisContext.RegisterCompilationStartAction' API. An instance of this type will be created per-compilation and it won't outlive compilation's lifetime, hence avoiding memory leaks.",,,,,,AnalyzerPerformance,,,,
  +RS1009,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Only internal implementations of this interface are allowed,The author of this interface did not intend to have third party implementations of this interface and reserves the right to change it. Implementing this interface could therefore result in a source or binary compatibility issue with a future version of this interface.,,,,,,Compatibility,,,,
  +RS1010,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Create code actions should have a unique EquivalenceKey for FixAll occurrences support,"A CodeFixProvider that intends to support fix all occurrences must classify the registered code actions into equivalence classes by assigning it an explicit, non-null equivalence key which is unique across all registered code actions by this fixer. This enables the FixAllProvider to fix all diagnostics in the required scope by applying code actions from this fixer that are in the equivalence class of the trigger code action.",,,,,,Correctness,,,,
  +RS1011,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Use code actions that have a unique EquivalenceKey for FixAll occurrences support,"A CodeFixProvider that intends to support fix all occurrences must classify the registered code actions into equivalence classes by assigning it an explicit, non-null equivalence key which is unique across all registered code actions by this fixer. This enables the FixAllProvider to fix all diagnostics in the required scope by applying code actions from this fixer that are in the equivalence class of the trigger code action.",,,,,,Correctness,,,,
  +RS1012,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Start action has no registered actions,"An analyzer start action enables performing stateful analysis over a given code unit, such as a code block, compilation, etc. Careful design is necessary to achieve efficient analyzer execution without memory leaks. Use the following guidelines for writing such analyzers: 1. Define a new scope for the registered start action, possibly with a private nested type for analyzing each code unit. 2. If required, define and initialize state in the start action. 3. Register at least one non-end action that refers to this state in the start action. If no such action is necessary, consider replacing the start action with a non-start action. For example, a CodeBlockStartAction with no registered actions or only a registered CodeBlockEndAction should be replaced with a CodeBlockAction. 4. If required, register an end action to report diagnostics based on the final state.",,,,,,AnalyzerPerformance,,,,
  +RS1013,#N/A,Microsoft.CodeAnalysis,Microsoft.CodeAnalysis.Analyzers,Start action has no registered non-end actions,"An analyzer start action enables performing stateful analysis over a given code unit, such as a code block, compilation, etc. Careful design is necessary to achieve efficient analyzer execution without memory leaks. Use the following guidelines for writing such analyzers: 1. Define a new scope for the registered start action, possibly with a private nested type for analyzing each code unit. 2. If required, define and initialize state in the start action. 3. Register at least one non-end action that refers to this state in the start action. If no such action is necessary, consider replacing the start action with a non-start action. For example, a CodeBlockStartAction with no registered actions or only a registered CodeBlockEndAction should be replaced with a CodeBlockAction. 4. If required, register an end action to report diagnostics based on the final state.",,,,,,AnalyzerPerformance,,,,
  
positive.code: CA2209,AssembliesShouldDeclareMinimumSecurity,Desktop,#N/A,Assemblies should declare minimum security,"Assemblies specify security permission requests to communicate to administrators the minimum permissions that are required to execute the assembly, and to limit security vulnerabilities caused by mistakenly omitting demands at the type and member level. ",,7023,203,0.028905026,133.0745256,Security,Low,Cut,Deprecated rule,
  CA2210,AssembliesShouldHaveValidStrongNames,Microsoft.ApiDesignGuidelines,#N/A,Assemblies should have valid strong names,"The strong name protects clients from unknowingly loading an assembly that has been tampered with. Assemblies without strong names should not be deployed outside very limited scenarios. If you share or distribute assemblies that are not correctly signed, the assembly can be tampered with, the common language runtime might not load the assembly, or the user might have to disable verification on his or her computer.",Yes,2955771,8737,0.002955912,2189.060439,Design,High,,,None
  CA2211,NonConstantFieldsShouldNotBeVisible,Microsoft.ApiDesignGuidelines,#N/A,Non-constant fields should not be visible,Static fields that are neither constants nor read-only are not thread-safe. Access to such a field must be carefully controlled and requires advanced programming techniques to synchronize access to the class object.,Yes,752431,8608,0.011440252,513.6658574,Usage,High,Yes,,None
  CA2212,DoNotMarkServicedComponentsWithWebMethod,System.EnterpriseServices,#N/A,Do not mark serviced components with WebMethod,"A method in a type that inherits from System.EnterpriseServices.ServicedComponent is marked by using System.Web.Services.WebMethodAttribute. Because WebMethodAttribute and a ServicedComponent method have conflicting behavior and requirements for context and transaction flow, the behavior of the method will be incorrect in some scenarios.",Yes,26,0,0,,Usage,Low,Yes,,None
  CA2213,DisposableFieldsShouldBeDisposed,System.Runtime,System.Runtime.Analyzers,Disposable fields should be disposed,A type that implements System.IDisposable declares fields that are of types that also implement IDisposable. The Dispose method of the field is not called by the Dispose method of the declaring type.,Yes,347843,920,0.002644871,2095.142804,Usage,High,Ported,,Dataflow
  CA2214,DoNotCallOverridableMethodsInConstructors,System.Runtime,Microsoft.AnalyzerPowerPack,Do not call overridable methods in constructors,"When a constructor calls a virtual method, the constructor for the instance that invokes the method may not have executed.",Yes,681532,2824,0.004143606,1407.828453,Usage,High,Ported,,None
  CA2215,DisposeMethodsShouldCallBaseClassDispose,System.Runtime,#N/A,Dispose Methods Should Call Base Class Dispose,"If a type inherits from a disposable type, it must call the Dispose method of the base type from its own Dispose method.",Yes,37586,119,0.003166072,1445.01623,Usage,Low,Yes,,Dataflow
  
negative.code: CA1901,PInvokeDeclarationsShouldBePortable,System.Runtime.InteropServices,#N/A,PInvoke declarations should be portable,"This rule evaluates the size of each parameter and the return value of a P/Invoke, and verifies that the size of the parameter is correct when marshaled to unmanaged code on 32-bit and 64-bit operating systems.",Yes,114993,367,0.003191499,1585.672444,Portability,High,Ported,,See CA2101
  CA1903,UseOnlyApiFromTargetedFramework,System.Runtime,#N/A,Use only api from targeted framework,A member or type is using a member or type that was introduced in a service pack that was not included together with the targeted framework of the project.,Yes,114762,732,0.006378418,793.2685116,Portability,High,,,FrameworkCompatibilityService
  CA2000,DisposeObjectsBeforeLosingScope,System.Runtime,#N/A,Dispose Objects Before Losing Scope,"Because an exceptional event might occur that will prevent the finalizer of an object from running, the object should be explicitly disposed before all references to it are out of scope.",Yes,2950496,21737,0.007367236,878.1984362,Reliability,High,,,Dataflow
  CA2001,AvoidCallingProblematicMethods,ApiReview,#N/A,Avoid calling problematic methods,A member calls a potentially dangerous or problematic method.,Yes,279199,1198,0.004290846,1269.193408,Reliability,Low,Yes,,None
  CA2002,DoNotLockOnObjectsWithWeakIdentity,System.Runtime,System.Runtime.Analyzers,Do not lock on objects with weak identity,An object is said to have a weak identity when it can be directly accessed across application domain boundaries. A thread that tries to acquire a lock on an object that has a weak identity can be blocked by a second thread in a different application domain that has a lock on the same object.,Yes,123953,440,0.003549733,1434.828387,Reliability,High,Ported,,
  CA2003,DoNotTreatFibersAsThreads,System.Runtime.InteropServices,#N/A,Do not treat fibers as threads,A managed thread is being treated as a Win32 thread.,Yes,34,0,0,,Reliability,Low,,,
  CA2004,RemoveCallsToGCKeepAlive,System.Runtime,#N/A,Remove calls to GC.KeepAlive,"If you convert to SafeHandle usage, remove all calls to GC.KeepAlive (object). In this case, classes should not have to call GC.KeepAlive. This assumes they do not have a finalizer but rely on SafeHandle to finalize the OS handle for them.",Yes,16938,72,0.004250797,994.8398157,Reliability,Low,,,
  CA2006,UseSafeHandleToEncapsulateNativeResources,System.Runtime.InteropServices,#N/A,Use SafeHandle to encapsulate native resources,"Use of IntPtr in managed code might indicate a potential security and reliability problem. All uses of IntPtr must be reviewed to determine whether use of a SafeHandle, or similar technology, is required in its place.",Yes,63814,334,0.005233961,918.0266694,Reliability,Low,,,
  CA2100,ReviewSqlQueriesForSecurityVulnerabilities,Desktop,#N/A,Review SQL queries for security vulnerabilities,A method sets the System.Data.IDbCommand.CommandText property by using a string that is built from a string argument to the method. This rule assumes that the string argument contains user input. A SQL command string that is built from user input is vulnerable to SQL injection attacks.,Yes,418391,3364,0.008040326,699.1734406,Security,Low,No,,Dataflow
  CA2101,SpecifyMarshalingForPInvokeStringArguments,System.Runtime.InteropServices,System.Runtime.InteropServices.Analyzers,Specify marshaling for PInvoke string arguments,"A platform invoke member allows partially trusted callers, has a string parameter, and does not explicitly marshal the string. This can cause a potential security vulnerability.",Yes,230439,998,0.004330864,1238.218475,Globalization,High,Ported,,
  CA2102,CatchNonClsCompliantExceptionsInGeneralHandlers,System.Runtime,#N/A,Catch non-CLSCompliant exceptions in general handlers,A member in an assembly that is not marked by using the RuntimeCompatibilityAttribute or is marked RuntimeCompatibility(WrapNonExceptionThrows = false) contains a catch block that handles System.Exception and does not contain an immediately following general catch block.,Yes,2400,11,0.004583333,737.5006346,Security,Low,,,
  CA2103,ReviewImperativeSecurity,Desktop,#N/A,Review imperative security,A method uses imperative security and might be constructing the permission by using state information or return values that can change as long as the demand is active. Use declarative security whenever possible.,Yes,11291,80,0.007085289,571.9925201,Security,Low,,,
  CA2104,DoNotDeclareReadOnlyMutableReferenceTypes,System.Runtime,#N/A,Do not declare read only mutable reference types,An externally visible type contains an externally visible read-only field that is a mutable reference type. A mutable type is a type whose instance data can be modified.,Yes,292444,8727,0.029841611,183.1684881,Security,Low,Cut,,Hardcoded list of immutable types
  CA2105,ArrayFieldsShouldNotBeReadOnly,System.Runtime,#N/A,Array fields should not be read only,"When you apply the read-only (ReadOnly in Visual Basic) modifier to a field that contains an array, the field cannot be changed to reference a different array. However, the elements of the array that are stored in a read-only field can be changed.",Yes,58839,177,0.003008209,1585.549919,Security,Low,,,
  CA2106,SecureAsserts,Desktop,#N/A,Secure asserts,A method asserts a permission and no security checks are performed on the caller. Asserting a security permission without performing any security checks can leave an exploitable security weakness in your code.,Yes,13428,138,0.010277033,401.6734505,Security,Low,,,
  CA2107,ReviewDenyAndPermitOnlyUsage,Desktop,#N/A,Review deny and permit only usage,The PermitOnly method and CodeAccessPermission.Deny security actions should be used only by those who have an advanced knowledge of .NET Framework security. Code that uses these security actions should undergo a security review.,Yes,938,16,0.017057569,174.2453914,Security,Low,,,
  