> For the complete documentation index, see [llms.txt](https://framework.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://framework.aic.io/technical-guidelines-code-standards-and-tech-stack/templates-and-reference-assets/nuget.config-template.md).

# NuGet.config Template

## Purpose

`nuget.config` controls package sources and reduces supply-chain risk.

## Template

```xml
<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    <!-- Add approved private feeds here. -->
  </packageSources>

  <packageSourceMapping>
    <packageSource key="nuget.org">
      <package pattern="*" />
    </packageSource>
  </packageSourceMapping>
</configuration>
```

## Rules

* Use approved feeds only.
* Avoid developer-machine package sources.
* Use package source mapping for high-assurance repositories.
* Do not use untrusted internal mirrors without security review.
* Document private feed authentication.