anchor.diff:  CA2243,AttributeStringLiteralsShouldParseCorrectly,System.Runtime,#N/A,Attribute string literals should parse correctly,"The string literal parameter of an attribute does not parse correctly for a URL, a GUID, or a version.",Yes,63488,553,0.008710307,551.3802662,Usage,High,Yes,,WordParser
   CA2208,InstantiateArgumentExceptionsCorrectly,System.Runtime,#N/A,Instantiate argument exceptions correctly,"A call is made to the default (parameterless) constructor of an exception type that is or derives from ArgumentException, or an incorrect string argument is passed to a parameterized constructor of an exception type that is or derives from ArgumentException.",Yes,774590,2637,0.003404382,1729.850661,Usage,High,,,IOperation
   CA2240,ImplementISerializableCorrectly,Desktop,#N/A,Implement ISerializable correctly,"To fix a violation of this rule, make the GetObjectData method visible and overridable, and make sure that all instance fields are included in the serialization process or explicitly marked by using the NonSerializedAttribute attribute.",Yes,254727,2301,0.0090332,598.4673019,Usage,Low,Yes,,None
  -CA2123,#N/A,System.Runtime,#N/A,Override link demands should be identical to base,"This rule matches a method to its base method, which is either an interface or a virtual method in another type, and then compares the link demands on each. If this rule is violated, a malicious caller can bypass the link demand just by calling the unsecured method.",No,138994,437,0.003144021,1635.802273,Security,High,,,FxCopSDKUtilties
  +CA2123,OverrideLinkDemandsShouldBeIdenticalToBase,System.Runtime,#N/A,Override link demands should be identical to base,"This rule matches a method to its base method, which is either an interface or a virtual method in another type, and then compares the link demands on each. If this rule is violated, a malicious caller can bypass the link demand just by calling the unsecured method.",No,138994,437,0.003144021,1635.802273,Security,High,,,FxCopSDKUtilties
   CA1810,InitializeReferenceTypeStaticFieldsInline,System.Runtime,#N/A,Initialize reference type static fields inline,"When a type declares an explicit static constructor, the just-in-time (JIT) compiler adds a check to each static method and instance constructor of the type to make sure that the static constructor was previously called. Static constructor checks can decrease performance.",Yes,755408,2731,0.003615265,1625.933867,Performance,High,,,None
   CA2105,ArrayFieldsShouldNotBeReadOnly,System.Runtime,#N/A,Array fields should not be read only,"When you apply the read-only (ReadOnly in Visual Basic) modifier to a field that contains an array, the field cannot be changed to reference a different array. However, the elements of the array that are stored in a read-only field can be changed.",Yes,58839,177,0.003008209,1585.549919,Security,Low,,,
  -CA1805,#N/A,System.Runtime,#N/A,Do not initialize unnecessarily,"The common language runtime initializes all fields to their default values before running the constructor. In most cases, initializing a field to its default value in a constructor is redundant, which degrades performance and adds to maintenance costs. One case where it is not redundant occurs when the constructor calls another constructor of the same class or a base class constructor and that constructor initializes the field to a non-default value. In this case, changing the value of the field back to its default value can be appropriate.",,900111,3408,0.0037862,1572.631276,Performance,High,Yes,,
  +CA1805,DoNotInitializeUnnecessarily,System.Runtime,#N/A,Do not initialize unnecessarily,"The common language runtime initializes all fields to their default values before running the constructor. In most cases, initializing a field to its default value in a constructor is redundant, which degrades performance and adds to maintenance costs. One case where it is not redundant occurs when the constructor calls another constructor of the same class or a base class constructor and that constructor initializes the field to a non-default value. In this case, changing the value of the field back to its default value can be appropriate.",,900111,3408,0.0037862,1572.631276,Performance,High,Yes,,
   CA2211,NonConstantFieldsShouldNotBeVisible,Microsoft.Api.Design.Guidelines,#N/A,Non-constant fields should not be visible,Static fields that are neither constants nor read-only are not thread-safe. Access to such a field must be carefully controlled and requires advanced programming techniques to synchronize access to the class object.,Yes,752431,8608,0.011440252,513.6658574,Usage,High,Yes,,None
   CA2002,DoNotLockOnObjectsWithWeakIdentity,System.Runtime,System.Runtime.Analyzers,Do not lock on objects with weak identity,An object is said to have a weak identity when it can be directly accessed across application domain boundaries. A thread that tries to acquire a lock on an object that has a weak identity can be blocked by a second thread in a different application domain that has a lock on the same object.,Yes,123953,440,0.003549733,1434.828387,Reliability,High,Ported,,
   CA1802,UseLiteralsWhereAppropriate,System.Runtime,#N/A,Use literals where appropriate,"A field is declared static and read-only (Shared and ReadOnly in Visual Basic), and is initialized by using a value that is computable at compile time. Because the value that is assigned to the targeted field is computable at compile time, change the declaration to a const (Const in Visual Basic) field so that the value is computed at compile time instead of at run?time.",Yes,156024,573,0.003672512,1414.070674,Performance,High,,,None
   CA2227,CollectionPropertiesShouldBeReadOnly,Microsoft.Api.Design.Guidelines,#N/A,Collection properties should be read only,A writable collection property allows a user to replace the collection with a different collection. A read-only property stops the collection from being replaced but still allows the individual members to be set.,Yes,1479039,18904,0.012781272,482.7359551,Usage,High,Yes,,None
  -CA1800,DoNotCastUnnecessarily,System.Runtime,#N/A,Do not cast unnecessarily,"Duplicate casts decrease performance, especially when the casts are performed in compact iteration statements.",Yes,1161244,5060,0.004357396,1391.868776,Performance,High,No,,RemoveUnnecessaryCast IDE CodeFix
  +CA1800,DoNotCastUnnecessarily,System.Runtime,#N/A,Do not cast unnecessarily,"Duplicate casts decrease performance, especially when the casts are performed in compact iteration statements.",Yes,1161244,5060,0.004357396,1391.868776,Performance,High,Cut,,RemoveUnnecessaryCast IDE CodeFix
   CA2233,OperationsShouldNotOverflow,System.Runtime,#N/A,Operations should not overflow,You should not perform arithmetic operations without first validating the operands. This makes sure that the result of the operation is not outside the range of possible values for the data types that are involved.,Yes,177875,717,0.004030921,1302.460516,Usage,High,,,IOperation
  -CA2225,OperatorOverloadsHaveNamedAlternates,Microsoft.Api.Design.Guidelines,#N/A,Operator overloads have named alternates,"An operator overload was detected, and the expected named alternative method was not found. The named alternative member provides access to the same functionality as the operator and is provided for developers who program in languages that do not support overloaded operators.",Yes,71083,1385,0.019484265,249.009433,Usage,High,Yes,,
  +CA2225,OperatorOverloadsHaveNamedAlternates,Microsoft.Api.Design.Guidelines,#N/A,Operator overloads have named alternates,"An operator overload was detected, and the expected named alternative method was not found. The named alternative member provides access to the same functionality as the operator and is provided for developers who program in languages that do not support overloaded operators.",Yes,71083,1385,0.019484265,249.009433,Usage,High,Yes,,HardCoded list of alternates
   CA2004,RemoveCallsToGCKeepAlive,System.Runtime,#N/A,Remove calls to GC.KeepAlive,"If you convert to SafeHandle usage, remove all calls to GC.KeepAlive (object). In this case, classes should not have to call GC.KeepAlive. This assumes they do not have a finalizer but rely on SafeHandle to finalize the OS handle for them.",Yes,16938,72,0.004250797,994.8398157,Reliability,Low,,,
  -CA2228,DoNotShipUnreleasedResourceFormats,System.Runtime,#N/A,Do not ship unreleased resource formats,Resource files that were built by using prerelease versions of the .NET Framework might not be usable by supported versions of the .NET Framework.,Yes,2033,45,0.022134776,149.4542954,Usage,High,Cut,,
  +CA2228,DoNotShipUnreleasedResourceFormats,System.Runtime,#N/A,Do not ship unreleased resource formats,Resource files that were built by using prerelease versions of the .NET Framework might not be usable by supported versions of the .NET Framework.,Yes,2033,45,0.022134776,149.4542954,Usage,High,Cut,,N/A
   CA2111,PointersShouldNotBeVisible,System.Runtime,#N/A,Pointers should not be visible,"A pointer is not private, internal, or read-only. Malicious code can change the value of the pointer, which potentially gives access to arbitrary locations in memory or causes application or system failures.",Yes,49556,248,0.005004439,938.1862479,Security,Low,,,
   CA2119,SealMethodsThatSatisfyPrivateInterfaces,System.Runtime,#N/A,Seal methods that satisfy private interfaces,"An inheritable public type provides an overridable method implementation of an internal (Friend in Visual Basic) interface. To fix a violation of this rule, prevent the method from being overridden outside the assembly.",Yes,16649,76,0.004564839,924.7617285,Security,Low,,,
   CA2109,ReviewVisibleEventHandlers,System.Runtime,#N/A,Review visible event handlers,A public or protected event-handling method was detected. Event-handling methods should not be exposed unless absolutely necessary.,Yes,249217,1465,0.005878411,918.0333759,Security,High,,,None
  -CA2135,#N/A,System.Runtime,#N/A,Level2 methods should not be protected with link demands,"LinkDemands are deprecated in the level 2 security rule set. Instead of using LinkDemands to enforce security at just-in-time (JIT) compilation time, mark the methods, types, and fields with the SecurityCriticalAttribute attribute.",No,72950,390,0.005346127,909.6351163,Security,Low,,,
  -CA2000,#N/A,System.Runtime,#N/A,Dispose Objects Before Losing Scope,"Because an exceptional event might occur that will prevent the finalizer of an object from running, the object should be explicitly disposed before all references to it are out of scope.",Yes,2950496,21737,0.007367236,878.1984362,Reliability,High,,,Dataflow
  -CA2140,#N/A,System.Runtime,#N/A,Transparent code must not reference security critical items,"Methods that are marked by SecurityTransparentAttribute call nonpublic members that are marked as SecurityCritical. This rule analyzes all methods and types in an assembly that is mixed transparent/critical, and flags any calls from transparent code to nonpublic critical code that are not marked as SecurityTreatAsSafe.",No,13305,64,0.004810222,857.3440307,Security,Low,,,
  +CA2135,SecurityRuleSetLevel2MethodsShouldNotBeProtectedWithLinkDemands,System.Runtime,#N/A,Level2 methods should not be protected with link demands,"LinkDemands are deprecated in the level 2 security rule set. Instead of using LinkDemands to enforce security at just-in-time (JIT) compilation time, mark the methods, types, and fields with the SecurityCriticalAttribute attribute.",No,72950,390,0.005346127,909.6351163,Security,Low,,,
  +CA2000,DisposeObjectsBeforeLosingScope,System.Runtime,#N/A,Dispose Objects Before Losing Scope,"Because an exceptional event might occur that will prevent the finalizer of an object from running, the object should be explicitly disposed before all references to it are out of scope.",Yes,2950496,21737,0.007367236,878.1984362,Reliability,High,,,Dataflow
  +CA2140,TransparentMethodsMustNotReferenceCriticalCode,System.Runtime,#N/A,Transparent code must not reference security critical items,"Methods that are marked by SecurityTransparentAttribute call nonpublic members that are marked as SecurityCritical. This rule analyzes all methods and types in an assembly that is mixed transparent/critical, and flags any calls from transparent code to nonpublic critical code that are not marked as SecurityTreatAsSafe.",No,13305,64,0.004810222,857.3440307,Security,Low,,,
   CA1308,NormalizeStringsToUppercase,System.Runtime,#N/A,Normalize strings to uppercase,Strings should be normalized to uppercase. A small group of characters cannot make a round trip when they are converted to lowercase.,Yes,465112,3117,0.006701612,845.7006816,Naming,High,,,None
   CA1903,UseOnlyApiFromTargetedFramework,System.Runtime,#N/A,Use only api from targeted framework,A member or type is using a member or type that was introduced in a service pack that was not included together with the targeted framework of the project.,Yes,114762,732,0.006378418,793.2685116,Portability,High,,,FrameworkCompatibilityService
   CA1302,DoNotHardcodeLocaleSpecificStrings,System.Runtime,#N/A,Do not hardcode locale specific strings,"The System.Environment.SpecialFolder enumeration contains members that refer to special system folders. The locations of these folders can have different values on different operating systems; the user can change some of the locations; and the locations are localized. The Environment.GetFolderPath method returns the locations that are associated with the Environment.SpecialFolder enumeration, localized and appropriate for the currently running computer.",Yes,13519,71,0.005251868,786.5667551,Globalization,Low,,,
  
positive.code: CA1018,MarkAttributesWithAttributeUsage,Microsoft.Api.Design.Guidelines,System.Runtime.Analyzers,Mark attributes with AttributeUsageAttribute,"When you define a custom attribute, mark it by using AttributeUsageAttribute to indicate where in the source code the custom attribute can be applied. The meaning and intended usage of an attribute will determine its valid locations in code.",Yes,114431,178,0.001555523,3251.989963,Design,High,Ported,,
  CA1048,DoNotDeclareVirtualMembersInSealedTypes,Microsoft.Api.Design.Guidelines,#N/A,Do not declare virtual members in sealed types,"Types declare methods as virtual so that inheriting types can override the implementation of the virtual method. By definition, a sealed type cannot be inherited. This makes a virtual method on a sealed type meaningless.",Yes,5014,6,0.001196649,3092.120705,Design,Low,,,
  CA1708,IdentifiersShouldDifferByMoreThanCase,Microsoft.Api.Design.Guidelines,Microsoft.AnalyzerPowerPack,Identifiers should differ by more than case,"Identifiers for namespaces, types, members, and parameters cannot differ only by case because languages that target the common language runtime are not required to be case-sensitive.",Yes,240275,455,0.001893664,2841.428034,Naming,High,Ported,,
  CA2220,FinalizersShouldCallBaseClassFinalizer,System.Runtime,#N/A,Finalizers should call base class finalizer,"Finalization must be propagated through the inheritance hierarchy. To guarantee this, types must call their base class Finalize method in their own Finalize method.",Yes,47,0,0,,Usage,Low,,,
  CA2212,DoNotMarkServicedComponentsWithWebMethod,System.EnterpriseServices,#N/A,Do not mark serviced components with WebMethod,"A method in a type that inherits from System.EnterpriseServices.ServicedComponent is marked by using System.Web.Services.WebMethodAttribute. Because WebMethodAttribute and a ServicedComponent method have conflicting behavior and requirements for context and transaction flow, the behavior of the method will be incorrect in some scenarios.",Yes,26,0,0,,Usage,Low,,,
  CA1001,TypesThatOwnDisposableFieldsShouldBeDisposable,Microsoft.Api.Design.Guidelines,System.Runtime.Analyzers,Types that own disposable fields should be disposable,"A class declares and implements an instance field that is a System.IDisposable type, and the class does not implement IDisposable. A class that declares an IDisposable field indirectly owns an unmanaged resource and should implement the IDisposable interface.",Yes,1133673,2747,0.002423097,2498.65648,Design,High,Ported,,Dataflow
  CA1717,OnlyFlagsEnumsShouldHavePluralNames,Microsoft.Api.Design.Guidelines,#N/A,Only FlagsAttribute enums should have plural names,Naming conventions dictate that a plural name for an enumeration indicates that more than one value of the enumeration can be specified at the same time.,Yes,389307,875,0.002247584,2487.245589,Naming,High,,,None
  CA1053,StaticHolderTypesShouldNotHaveConstructors,Microsoft.Api.Design.Guidelines,#N/A,Static holder types should not have constructors,A public or nested public type declares only static members and has a public or protected default constructor. The constructor is unnecessary because calling static members does not require an instance of the type. The string overload should call the uniform resource identifier (URI) overload by using the string argument for safety and security.,Yes,1300683,3250,0.002498687,2446.953502,Design,High,Ported,,
  
negative.code: CA2102,CatchNonClsCompliantExceptionsInGeneralHandlers,System.Runtime,#N/A,Catch non-CLSCompliant exceptions in general handlers,A member in an assembly that is not marked by using the RuntimeCompatibilityAttribute or is marked RuntimeCompatibility(WrapNonExceptionThrows = false) contains a catch block that handles System.Exception and does not contain an immediately following general catch block.,Yes,2400,11,0.004583333,737.5006346,Security,Low,,,
  CA1823,AvoidUnusedPrivateFields,System.Runtime,#N/A,Avoid unused private fields,Private fields were detected that do not appear to be accessed in the assembly.,Yes,2037563,18054,0.008860585,712.0422748,Performance,High,,,None
  CA1900,ValueTypeFieldsShouldBePortable,System.Runtime,#N/A,Value type fields should be portable,This rule checks that structures that are declared by using explicit layout will align correctly when marshaled to unmanaged code on 64-bit operating systems.,Yes,21717,139,0.006400516,677.5703737,Portability,Low,,,
  CA2142,TransparentMethodsShouldNotBeProtectedWithLinkDemands,System.Runtime,#N/A,Transparent code should not be protected with LinkDemands,"This rule is raised on transparent methods that require LinkDemands to access them. Security transparent code should not be responsible for verifying the security of an operation, and therefore should not demand permissions.",No,3330,18,0.005405405,651.6521832,Security,Low,,,
  CA2117,AptcaTypesShouldOnlyExtendAptcaBaseTypes,System.Runtime,#N/A,Aptca types should only extend aptca base types,"When the APTCA is present on a fully trusted assembly, and a type in the assembly inherits from a type that does not allow for partially trusted callers, a security exploit is possible.",Yes,6740,43,0.006379822,600.1201791,Security,Low,,,
  CA2239,ProvideDeserializationMethodsForOptionalFields,Desktop,#N/A,Provide deserialization methods for optional fields,"A type has a field that is marked by using the System.Runtime.Serialization.OptionalFieldAttribute attribute, and the type does not provide deserialization event handling methods.",Yes,13047,393,0.030121867,136.6286708,Usage,Low,Yes,,None
  CA1814,PreferJaggedArraysOverMultidimensional,System.Runtime,#N/A,Prefer jagged arrays over multidimensional,"A jagged array is an array whose elements are arrays. The arrays that make up the elements can be of different sizes, leading to less wasted space for some sets of data.",Yes,163220,1424,0.008724421,597.492184,Performance,High,,,None
  CA1822,MarkMembersAsStatic,System.Runtime,#N/A,Mark members as static,"Members that do not access instance data or call instance methods can be marked as static (Shared in Visual Basic). After you mark the methods as static, the compiler will emit nonvirtual call sites to these members. This can give you a measurable performance gain for performance-sensitive code.",Yes,3382541,37372,0.011048499,590.9620138,Performance,Low,,,IOperation
  CA2238,ImplementSerializationMethodsCorrectly,Desktop,#N/A,Implement serialization methods correctly,"A method that handles a serialization event does not have the correct signature, return type, or visibility.",Yes,38890,1402,0.036050399,127.3172594,Usage,Low,Yes,,None
  CA1303,DoNotPassLiteralsAsLocalizedParameters,System.Runtime,#N/A,Do not pass literals as localized parameters,"An externally visible method passes a string literal as a parameter to a constructor or method in the .NET Framework class library, and that string should be localizable.",Yes,1370581,20484,0.014945487,410.6192633,Globalization,Low,,,Dataflow
  CA2141,TransparentMethodsMustNotSatisfyLinkDemands,System.Runtime,#N/A,Transparent methods must not satisfy LinkDemands,"A security transparent method calls a method in an assembly that is not marked by using the APTCA, or a security transparent method satisfies a LinkDemand for a type or a method.",No,16361,245,0.014974635,281.3965015,Security,Low,,,
  CA2149,TransparentMethodsMustNotCallNativeCode,System.Runtime,#N/A,Transparent methods must not call into native code,"This rule is raised on any transparent method that calls directly into native code (for example, through a P/Invoke). Violations of this rule lead to a MethodAccessException in the level 2 transparency model and a full demand for UnmanagedCode in the level 1 transparency model.",No,4351,61,0.014019766,259.5328049,Security,Low,,,
  CA2136,TransparencyAnnotationsShouldNotConflict,System.Runtime,#N/A,Members should not have conflicting transparency annotations,"Critical code cannot occur in a 100 percent?transparent assembly. This rule analyzes 100 percent?transparent assemblies for any SecurityCritical annotations at the type, field, and method levels.",No,6481,114,0.017589878,216.6951925,Security,Low,,,
  CA2230,UseParamsForVariableArguments,Microsoft.Api.Design.Guidelines,#N/A,Use params for variable arguments,A public or protected type contains a public or protected method that uses the VarArgs calling convention instead of the params keyword.,Yes,126,8,0.063492063,33.08083609,Usage,High,,,None
  CA2223,MembersShouldDifferByMoreThanReturnType,Microsoft.Api.Design.Guidelines,#N/A,Members should differ by more than return type,"Although the common language runtime allows the use of return types to differentiate between otherwise identical members, this feature is not in the Common Language Specification, nor is it a common feature of .NET programming languages.",Yes,12,1,0.083333333,12.95017495,Usage,High,,,None
  Async001,#N/A,Microsoft.Api.Design.Guidelines,AsyncPackage,Avoid Async Void,#N/A,,,,,,Usage,,,,
  CA2116,AptcaMethodsShouldOnlyCallAptcaMethods,System.Runtime,#N/A,Aptca methods should only call aptca methods,"When the APTCA (AllowPartiallyTrustedCallersAttribute) is present on a fully trusted assembly, and the assembly executes code in another assembly that does not allow for partially trusted callers, a security exploit is possible.",Yes,20253,864,0.042660347,100.9482975,Security,Low,,,
  CA1821,RemoveEmptyFinalizers,System.Runtime,Microsoft.AnalyzerPowerPack,Remove empty finalizers,"Whenever you can, avoid finalizers because of the additional performance overhead that is involved in tracking object lifetime. An empty finalizer incurs added overhead and delivers no benefit.",Yes,39675,3102,0.078185255,58.81565423,Performance,Low,,,
  CA2110,AssembliesShouldHaveValidStrongNames,System.Runtime,#N/A,Secure GetObjectData overrides,"The System.Runtime.Serialization.ISerializable.GetObjectData(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext) method is declared in the ISerializable interface. This interface is implemented by types that provide custom serialization logic. GetObjectData is protected by a security check for System.Security.Permissions.SecurityPermissionAttribute.SerializationFormatter security permission. If an implementation of GetObjectData is not protected by the same security check, callers can call the implementation to bypass security on the interface and gain access to data serialized by the type.",,36,1,0.027777778,56.02689003,Security,Low,???,,
  CA2127,#N/A,System.Runtime,#N/A,Security transparent assemblies should not contain security critical code,"This rule analyzes 100% transparent assemblies for any SecurityCritical annotations at the type, field, and method level. This rule is helpful because it flags code that exists in a 100% transparent assembly. Code in a 100% transparent assembly triggers either a security exception or unexpected behavior at run time.",,795,0,0,,Security,Low,,,
  CA2132,DefaultConstructorsMustHaveConsistentTransparency,System.Runtime,#N/A,Default constructors must be at least as critical as base type default constructors,"Types and members that have the SecurityCriticalAttribute cannot be used by Silverlight application code. Security-critical types and members can be used only by trusted code in the .NET Framework for Silverlight class library. Because a public or protected construction in a derived class must have the same or greater transparency than its base class, a class in an application cannot be derived from a class marked as SecurityCritical.",No,467,0,0,,Security,Low,,,
  CA2138,TransparentMethodsMustNotCallSuppressUnmanagedCodeSecurityMethods,System.Runtime,#N/A,Transparent methods must not call methods with the SuppressUnmanagedCodeSecurity attribute,A security transparent method calls a method that is marked by using the SuppressUnmanagedCodeSecurityAttribute attribute.,No,230,0,0,,Security,Low,,,
  CA2145,TransparentMethodsShouldNotUseSuppressUnmanagedCodeSecurity,System.Runtime,#N/A,Transparent methods should not be decorated with the SuppressUnmanagedCodeSecurityAttribute,Methods that are decorated by the SuppressUnmanagedCodeSecurityAttribute attribute have an implicit LinkDemand put upon any method that calls it. This LinkDemand requires that the calling code be security critical. Marking the method that uses SuppressUnmanagedCodeSecurity by using the SecurityCriticalAttribute attribute makes this requirement more obvious for callers of the method.,No,155,0,0,,Security,Low,,,
  CA2137,TransparentMethodsMustBeVerifiable,System.Runtime,#N/A,Transparent methods must contain only verifiable IL,"A method contains unverifiable code or returns a type by reference. This rule is raised on attempts by security transparent code to execute unverifiable microsoft intermediate language (MISL). However, the rule does not contain a full IL verifier, and instead uses heuristics to catch most violations of MSIL verification.",No,124,0,0,,Security,Low,,,
  CA2147,SecurityTransparentCodeShouldNotAssert,System.Runtime,#N/A,Transparent methods may not use security asserts,"This rule analyzes all methods and types in an assembly that is either 100 percent?transparent or mixed transparent/critical, and flags any declarative or imperative use of Assert.",No,91,0,0,,Security,Low,,,
  CA2144,TransparentMethodsShouldNotLoadAssembliesFromByteArrays,System.Runtime,#N/A,Transparent code should not load assemblies from byte arrays,"The security review for transparent code is not as complete as the security review for critical code because transparent code cannot perform security sensitive actions. Assemblies that are loaded from a byte array might not be noticed in transparent code, and that byte array might contain critical, or more important safe-critical code, that does have to be audited.",No,72,0,0,,Security,Low,,,
  CA2133,DelegatesMustBindWithConsistentTransparency,System.Runtime,#N/A,Delegates must bind to methods with consistent transparency,This warning is raised on a method that binds a delegate that is marked by using the SecurityCriticalAttribute to a method that is transparent or that is marked by using the SecuritySafeCriticalAttribute. The warning also is raised on a method that binds a delegate that is transparent or safe-critical to a critical method.,No,69,0,0,,Security,Low,,,
  Async003,#N/A,Microsoft.Api.Design.Guidelines,AsyncPackage,Don't Pass Async Lambdas as Void Returning Delegate Types,#N/A,,,,,,Usage,,,,
  CA2121,StaticConstructorsShouldBePrivate,System.Runtime,#N/A,Static constructors should be private,"The system calls the static constructor before the first instance of the type is created or any static members are referenced. If a static constructor is not private, it can be called by code other than the system. Depending on the operations that are performed in the constructor, this can cause unexpected behavior.",Yes,44,0,0,,Security,Low,,,
  CA2139,TransparentMethodsMustNotHandleProcessCorruptingExceptions,System.Runtime,#N/A,Transparent methods may not use the HandleProcessCorruptingExceptions attribute,"This rule is raised by any method that is transparent and attempts to handle a process corrupting exception by using the HandleProcessCorruptedStateExceptionsAttribute attribute. A process corrupting exception is a CLR version 4.0 exception classification of exceptions such as AccessViolationException. The HandleProcessCorruptedStateExceptionsAttribute attribute may be used only by security critical methods, and will be ignored if it is applied to a transparent method.",No,35,0,0,,Security,Low,,,
  CA2129,#N/A,System.Runtime,#N/A,Security transparent methods should not reference non-public security critical members,This code analysis rule analyzes all methods and types in an assembly which is mixed transparent/critical. This rule also flags any calls from transparent code to non-public critical code that are not marked SecurityTreatAsSafe.,,11,0,0,,Security,Low,,,
  Async004,#N/A,Microsoft.Api.Design.Guidelines,AsyncPackage,Don't Store Async Lambdas as Void Returning Delegate Types,#N/A,,,,,,Usage,,,,
  CA2130,ConstantsShouldBeTransparent,System.Runtime,#N/A,Security critical constants should be transparent,Transparency enforcement is not enforced for constant values because compilers inline constant values so that no lookup is required at run time. Constant fields should be security transparent so that code reviewers do not assume that transparent code cannot access the constant.,No,7,0,0,,Security,Low,,,
  CA2131,CriticalTypesMustNotParticipateInTypeEquivalence,System.Runtime,#N/A,Security critical types may not participate in type equivalence,"A type participates in type equivalence and either the type itself, or a member or field of the type, is marked by using the SecurityCriticalAttribute attribute. This rule occurs on any critical types or types that contain critical methods or fields that are participating in type equivalence. When the CLR detects such a type, it does not load it with a TypeLoadException at run time. Typically, this rule is raised only when users implement type equivalence manually instead of in by relying on tlbimp and the compilers to do the type equivalence.",No,7,0,0,,Security,Low,,,
  CA2128,#N/A,System.Runtime,#N/A,Security transparent code should not assert,"This rule analyzes all methods and types in an assembly which is either 100% transparent or mixed transparent/critical, and flags any declarative or imperative usage of CodeAccessPermission.Assert.",,3,0,0,,Security,Low,,,
  CA2150,TransparentCodeMustNotUseCriticalAttributes,System.Runtime,#N/A,#N/A,#N/A,No,,,,,,Low,,,
  CA2151,FieldsWithCriticalTypesShouldBeCriticalFxCopRule,System.Runtime,#N/A,#N/A,#N/A,No,,,,,,Low,,,
  CA2153,DoNotCatchCorruptedStateExceptionsInGeneralHandlers,System.Runtime,Desktop.Analyzers,Do not catch corrupted state exceptions in general handlers.,Do not author general catch handlers in code that receives corrupted state exceptions.,No,,,,,,,Yes,,
  CA5122,PInvokesShouldNotBeSafeCriticalFxCopRule,System.Runtime,#N/A,#N/A,#N/A,No,,,,,,Low,,,
  CA900,AptcaAssembliesShouldBeReviewed,System.Runtime,#N/A,Aptca assemblies should be reviewed,Microsoft only allows certain assemblies to have the AllowPartiallyTrustedCallers attribute. This rule can be ignored if the assembly is not for distribution outside of Microsoft.,No,,,,,,,Cut,,
  CA901,AptcaTypesShouldBeReviewed,System.Runtime,#N/A,Aptca types should be reviewed,"Types not on the list must either have both a LinkDemand and an InheritanceDemand, or have a LinkDemand and be sealed. This is a requirement of RTM security signoff.",No,,,,,,,Cut,,
  CA908,AvoidTypesThatRequireJitCompilationInPrecompiledAssemblies,System.Runtime,#N/A,Avoid types that require JIT compilation in precompiled assemblies,"Assemblies that are precompiled (using ngen.exe) should only instantiate generic types that will not cause JIT compilation at runtime. Generic types with value type type parameters (outside of a special set of supported runtime generic types) will always cause JIT compilation, even if the encapsulating assembly has been precompiled. If this is not an precompiled assembly this message should be suppressed or this rule should be disabled.",No,,,,,,,Cut,,
  CA909,UseFrameworksThatSatisfySecurityRequirements,System.Runtime,#N/A,#N/A,#N/A,No,,,,,,,Cut,Deprecated rule checking for insecure/beta framework use,
  CA1404,CallGetLastErrorImmediatelyAfterPInvoke,System.Runtime.InteropServices,#N/A,Call GetLastError immediately after PInvoke,"A platform invoke method accesses unmanaged code and is defined by using the Declare keyword in Visual Basic or the System.Runtime.InteropServices.DllImportAttribute attribute. Generally, upon failure, unmanaged functions call the Win32 SetLastError function to set an error code that is associated with the failure. The caller of the failed function calls the Win32 GetLastError function to retrieve the error code and determine the cause of the failure. The error code is maintained on a per-thread basis and is overwritten by the next call to SetLastError. After a call to a failed platform invoke method, managed code can retrieve the error code by calling the GetLastWin32Error method. Because the error code can be overwritten by internal calls from other managed class library methods, the GetLastError or GetLastWin32Error method should be called immediately after the platform invoke method call.",Yes,32639,62,0.001899568,2376.19124,Interoperability,Low,,,
  CA1402,AvoidOverloadsInComVisibleInterfaces,System.Runtime.InteropServices,#N/A,Avoid overloads in ComVisible interfaces,"When overloaded methods are exposed to COM clients, only the first method overload retains its name. Subsequent overloads are uniquely renamed by appending to the name an underscore character '_' and an integer that corresponds to the order of declaration of the overload.",Yes,36284,88,0.002425311,1880.053464,Interoperability,Low,,,
  CA1415,DeclarePInvokesCorrectly,System.Runtime.InteropServices,#N/A,Declare PInvokes correctly,"A platform invoke method accesses unmanaged code and is defined by using the Declare keyword in Visual Basic or the System.Runtime.InteropServices.DllImportAttribute. Currently, this rule looks for platform invoke method declarations that target Win32 functions that have a pointer to an OVERLAPPED structure parameter and the corresponding managed parameter is not a pointer to a System.Threading.NativeOverlapped structure.",Yes,7117,17,0.002388647,1612.752794,Interoperability,Low,,,
  