Annotations

Since 2.2.0 you can express protect/keep rules in source with attributes, instead of (or alongside) config-file rules. Attributes travel with the code, survive refactors, and read naturally at the point they apply.

Install

dotnet add package Nebula.Annotations

The attributes are build-time metadata only: Nebula reads them while protecting and strips them from the output, so your protected assembly carries no runtime dependency on the package.

Attributes

using Nebula.Annotations;

[Keep]                                   // keep this type's name (members still protected)
public class PluginContract { }

[Exclude]                                // exclude from obfuscation entirely (name preserved)
public class InteropSurface { }

public class Repository
{
    [Rename(false)]                      // keep this member's name
    public void BoundByReflection() { }

    [Protect(ProtectionKind.Virtualize)] // virtualize this method (Pro)
    public static int Hotpath(int a, int b) => a * b + 1;

    [EncryptStrings]                      // encrypt the string literals in this method
    public string Secret() => "do-not-ship-in-cleartext";
}

Attribute	Effect
[Keep]	Keep the element’s name. Applied to a type, keeps the type name; other transforms still apply.
[Exclude]	Exclude the element from obfuscation (name preserved).
[Rename(false)]	Keep the name (like [Keep]); [Rename(true)] is the default.
[Protect(ProtectionKind.Virtualize)]	Virtualize the method. Pro — a no-op on the Free edition. ProtectionKind.ControlFlow requests control-flow obfuscation.
[EncryptStrings]	Marks a method or type whose strings should be encrypted (requires string encryption to be enabled).

How attributes and rules combine

Attributes are merged with your config’s keep-list rules and with Nebula’s automatic detection (reflection, serialization, DI, XAML). A name preserved by any of them is preserved — annotations never weaken protection, they only add intent the tool might not infer. [Protect(Virtualize)] scopes virtualization to the annotated methods; it takes effect only on an edition that offers virtualization (Pro).

To see what automatic detection already preserves — before adding attributes — run nebula doctor and review its proposal.

Verify it

After a protected build, open the Protection Report: a [Keep] type appears in the residual public surface (its name is intentionally in the clear), and a [Protect(Virtualize)] method is counted under methods virtualized. The annotations themselves do not appear in the output assembly.