Where to start. Comparing advisories per package isn't a good metric. It assumes the usage and visibility is the same. Assuming the much smaller community aroun

Where to start. Comparing advisories per package isn't a good metric. It assumes the usage and visibility is the same. Assuming the much smaller community around nuget packages won't bite you just as hard as bigger communities in terms of supply-chain attacks is a fallacy. Provided you can even meet your supply chain needs, and that's not a given in dotnet. And not comparing ASP.net to more mature web frameworks is also a strange choice. At the very least, you need very capable developers not to shoot yourself in the food with the enterprisy dependency injection magic. In my opinion much more so than with other frameworks. I mean, if you have a steady supply of highly-qualified dotnet engineers, go for it...