Mutable static field (ARCH305)

Key dotnet.security.mutable-static-field · Severity warning · Category security · CWE CWE-362

Public mutable static fields can be changed by any code, causing cross-thread race conditions and corruption of security-relevant state.

Incorrect

public class Config
{
    public static string ApiBaseUrl = "https://api.example.com";
}

Correct

public class Config
{
    public static string ApiBaseUrl { get; } = "https://api.example.com";
}

Fix

Make the static field const/readonly or expose it through a read-only property; avoid public mutable static state.