Old and new, one pipeline.
All of it runs behind a single B5 Secure pipeline on .NET 10 — ASP.NET Core minimal APIs and GraphQL alongside co-hosted ServiceStack — so one security contract governs every surface, legacy and modern. Modernization becomes additive: new endpoints inherit the same guarantees the day they ship, and old ones are upgraded in place rather than rewritten.
1. Why one host and one contract
Most security failures in mixed estates are not failures of any one control — they are inconsistency between surfaces. The new GraphQL gateway authorizes one way, the legacy SOAP-era service another, and the gap between them is where an attacker pivots. The only durable fix is for every surface to be governed by the same security contract, enforced in one place. B5 Secure achieves that by hosting old and new together and running them all through a single Never Trust pipeline.
2. The surfaces, side by side
On .NET 10, a single host runs ASP.NET Core minimal APIs and GraphQL for new development, and co-hosted ServiceStack for the request-DTO services carried forward from earlier systems. They are not bridged by a gateway that re-implements security at the edge; they are mounted in the same process behind the same pipeline, so the authentication, signing, firewalling, and authorization stages apply identically to a minimal-API route, a GraphQL resolver, and a ServiceStack service.
One host is not just operational tidiness — it is a security property. A request cannot reach a co-hosted ServiceStack service without traversing the same pipeline a minimal-API call does, which removes the “side door” that bolt-on gateways so often leave open.
3. The single security contract
The contract is the full Never Trust pipeline applied uniformly: request signing for integrity, policy-based MFA where the risk is, the identity firewall over a strict allow-list core, activity-data authorization down to the record, and policy-driven suspension with CAE. Because these are pipeline stages rather than per-framework code, a GraphQL resolver and a legacy DTO service are subject to the same checks without each re-implementing them — and without each re-introducing the same bugs.
4. Migration without rewrite
This is what makes zero-trust modernization tractable. Legacy ServiceStack services are upgraded in place to .NET 10 and mounted under the pipeline; new capability is built as minimal APIs or GraphQL beside them under the identical contract. You migrate incrementally, with one security model spanning both states during the migration, not only after it — so there is never a window where half the estate runs an older, weaker model.
5. The calling convention
You register the pipeline once and map every surface through it; security is not redeclared per framework.
// One host, one pipeline — minimal APIs, GraphQL, and ServiceStack co-hosted
var app = builder.Build();
app.UseB5SecurityKit(); // the single Never Trust contract, for everything below
app.MapGroup("/api").MapMinimalApis(); // new REST surface
app.MapGraphQL("/graphql"); // new GraphQL surface
app.UseServiceStack(new AppHost()); // co-hosted legacy DTO services
// Same [Permission] semantics apply across all three surfaces6. What an attacker actually gets
An attacker hunting for the weakest surface finds they are all the same surface: the legacy service does not authorize more loosely than the GraphQL endpoint, because neither authorizes itself — the pipeline does. There is no un-signed legacy route, no GraphQL resolver that skipped the firewall, no DTO service with its own home-grown auth. The pivot between inconsistent surfaces, the most reliable move in a mixed estate, is simply not available.
7. Where this lands in an audit
One contract across all surfaces is the cleanest possible answer to consistent enforcement of access controls (SOC 2 CC6.1; ISO 27001 A.8.26) and to secure-SDLC expectations during modernization (NIST SSDF). Instead of evidencing controls framework-by-framework and explaining the seams, you evidence one pipeline and demonstrate that every surface inherits it — which is both stronger and far less work to attest.