I've spent about four and a half years building and maintaining ASP.NET Core APIs with SQL Server and Azure. A lot of that time goes into reading existing code, and the same handful of problems shows up again and again. None of them are exotic. They're the kind of thing that works fine in a demo and then bites you at 2 AM in production.

Here are six I see most, with the pattern I use instead. The code comes from a .NET 10 / EF Core 10 starter I maintain, but everything here also works on .NET 8 with small changes.

1. try/catch in every action (and stack traces in responses)

The symptom: every controller action is wrapped in try { ... } catch (Exception ex) { return BadRequest(ex.Message); } . Error formats differ between endpoints, real bugs come back as 400s, and sometimes ex.ToString() leaks a stack trace to the client.

The fix: throw meaningful exceptions from your services and turn them into responses in one place.…