NuGet.config Template

Purpose

nuget.config controls package sources and reduces supply-chain risk.

Template

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    <!-- Add approved private feeds here. -->
  </packageSources>

  <packageSourceMapping>
    <packageSource key="nuget.org">
      <package pattern="*" />
    </packageSource>
  </packageSourceMapping>
</configuration>

Rules

• Use approved feeds only.

• Avoid developer-machine package sources.

• Use package source mapping for high-assurance repositories.

• Do not use untrusted internal mirrors without security review.

• Document private feed authentication.