Example: application tech debt register¶

Doc gen writes docs/application/tech-debt.md to consolidate the CRITICAL and HIGH severity findings raised by every library analysis in the run.

What reviewers should check¶

The summary counts match the number of rows in the Critical findings and High findings tables exactly.
Each finding names the owning library with a link to its docs/libraries/<slug>/overview.md, not a bare library name.
Findings describe genuine debt with a concrete impact and an actionable recommendation; "modernize the code" is not a recommended action.
For a .NET Framework web application, an NTLM or Windows-authentication finding is expected — its absence is worth questioning.
Only CRITICAL and HIGH findings appear here; MEDIUM and LOW debt stays on the owning library's page.
## Sources is the terminal section and cites the project and configuration files the findings were drawn from.

Example¶

The document below is a complete, correct tech-debt.md for a fictional application.

View rendered example — the same document as a real page, so you can compare rendering as well as source.

---
title: Application tech debt register
summary: Consolidated CRITICAL and HIGH tech debt findings from all library analyses.
status: draft
owner: Claims Intake Team
last_reviewed: 2026-09-09
---

# Application tech debt register

This page consolidates all CRITICAL and HIGH severity tech debt findings from all library analyses.

## Critical findings

| Library | Finding | Impact | Recommended action |
| --- | --- | --- | --- |
| [SAIF.Claims.Intake.ServiceProxy](../libraries/saif-claims-intake-serviceproxy/overview.md) | The claims web service is called over HTTP with NTLM credentials passed by `CredentialCache.DefaultNetworkCredentials`; `Web.config` sets `requireSSL="false"` and no transport security is configured | NTLM handshakes and claim data, including claimant names and dates of injury, travel unencrypted across the network and are vulnerable to relay and interception on any shared segment | Move the claims web service endpoint to HTTPS, set `requireSSL="true"`, and require Kerberos by registering a service principal name so NTLM fallback can be disabled |
| [SAIF.Claims.Intake.Search](../libraries/saif-claims-intake-search/overview.md) | `ClaimSearchService.BuildLegacyFilter` concatenates the claimant last name and policy number directly into a SQL fragment passed to the service's pass-through filter parameter | A crafted claimant name submitted from Claim Search can alter the executed query, exposing claims the signed-in user is not entitled to see | Replace the pass-through filter with typed criteria fields on the service contract and delete `BuildLegacyFilter` once no caller remains |
| [SAIF.Claims.Intake.Capture](../libraries/saif-claims-intake-capture/overview.md) | `ClaimSubmissionCoordinator.Submit` writes the claim, the claimant update, and the triage assignment through three separate web service calls with no compensating action if a later call fails | A failure after the claim insert leaves a claim with stale claimant data and no adjuster queue assignment, and intake staff have no way to detect it from the screen | Add a single service operation that performs the three writes in one transaction, or record a submission state that a reconciliation job can resume |

## High findings

| Library | Finding | Impact | Recommended action |
| --- | --- | --- | --- |
| [SAIF.Claims.Intake.Search](../libraries/saif-claims-intake-search/overview.md) | The full result set for every search is stored in session state to support grid paging and sorting, up to 250 claim rows per user | Session memory grows with concurrent intake staff and forces sticky sessions, which blocks moving the application behind a load-balanced pair | Switch `UltraWebGrid` to server-side paging so each page request retrieves only the rows it renders |
| [SAIF.Claims.Intake.ServiceProxy](../libraries/saif-claims-intake-serviceproxy/overview.md) | Service call failures are caught in `ClaimsServiceProxy.Invoke` and returned as an empty result set with no logging | A web service outage is indistinguishable from a search that legitimately matched no claims, so staff open duplicate claims during an outage | Log the exception with the correlation identifier and surface a distinct service-unavailable message on the calling screen |
| [SAIF.Claims.Intake.Claimants](../libraries/saif-claims-intake-claimants/overview.md) | Claimant Social Security numbers are written to the application trace log by `ClaimantService.LogLookup` when `trace enabled="true"` is set, which it is in the staging configuration | Personally identifiable information accumulates in trace output that is retained on the web servers and readable by anyone with server access | Remove the identifier from the trace call, disable tracing in every deployed configuration, and purge existing trace files |
| [SAIF.Framework.Validation](../libraries/saif-framework-validation/overview.md) | The library targets .NET Framework 4.5.2 while the application targets 4.8, and it is referenced by file path rather than as a package | The version actually deployed depends on the build agent's file layout, so a validation fix can silently fail to reach production | Retarget the library to 4.8, publish it as a versioned NuGet package, and replace the file reference with a package reference |
| [SAIF.Claims.Intake.Triage](../libraries/saif-claims-intake-triage/overview.md) | Adjuster queue routing thresholds for injury severity are hard-coded as constants in `TriageRouter` | Every routing change requires a code change, a full build, and an application deployment, so business changes wait on a release window | Move the thresholds to configuration or a reference table read through the claims web service |

## Summary

| Severity | Count |
| --- | --- |
| CRITICAL | 3 |
| HIGH | 5 |
| **Total** | 8 |

## Related documentation
- [Application index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Data model](data-model.md)

## Sources
- src/SAIF.Claims.Intake/Web.config
- src/SAIF.Claims.Intake/SAIF.Claims.Intake.vbproj
- src/SAIF.Claims.Intake/Claims/ClaimSubmissionCoordinator.vb
- src/SAIF.Claims.Intake/Services/ClaimsServiceProxy.vb
- src/SAIF.Claims.Intake/Services/ClaimSearchService.vb
- src/SAIF.Claims.Intake/Claimants/ClaimantService.vb
- src/SAIF.Claims.Intake/Triage/TriageRouter.vb