Skip to content

Application tech debt register

This page consolidates all CRITICAL and HIGH severity tech debt findings from all library analyses.

Critical findings

Library Finding Impact Recommended action
SAIF.Claims.Intake.ServiceProxy The claims web service is called over HTTP with NTLM credentials passed by CredentialCache.DefaultNetworkCredentials; Web.config sets requireSSL="false" and no transport security is configured NTLM handshakes and claim data, including claimant names and dates of injury, travel unencrypted across the network and are vulnerable to relay and interception on any shared segment Move the claims web service endpoint to HTTPS, set requireSSL="true", and require Kerberos by registering a service principal name so NTLM fallback can be disabled
SAIF.Claims.Intake.Search ClaimSearchService.BuildLegacyFilter concatenates the claimant last name and policy number directly into a SQL fragment passed to the service's pass-through filter parameter A crafted claimant name submitted from Claim Search can alter the executed query, exposing claims the signed-in user is not entitled to see Replace the pass-through filter with typed criteria fields on the service contract and delete BuildLegacyFilter once no caller remains
SAIF.Claims.Intake.Capture ClaimSubmissionCoordinator.Submit writes the claim, the claimant update, and the triage assignment through three separate web service calls with no compensating action if a later call fails A failure after the claim insert leaves a claim with stale claimant data and no adjuster queue assignment, and intake staff have no way to detect it from the screen Add a single service operation that performs the three writes in one transaction, or record a submission state that a reconciliation job can resume

High findings

Library Finding Impact Recommended action
SAIF.Claims.Intake.Search The full result set for every search is stored in session state to support grid paging and sorting, up to 250 claim rows per user Session memory grows with concurrent intake staff and forces sticky sessions, which blocks moving the application behind a load-balanced pair Switch UltraWebGrid to server-side paging so each page request retrieves only the rows it renders
SAIF.Claims.Intake.ServiceProxy Service call failures are caught in ClaimsServiceProxy.Invoke and returned as an empty result set with no logging A web service outage is indistinguishable from a search that legitimately matched no claims, so staff open duplicate claims during an outage Log the exception with the correlation identifier and surface a distinct service-unavailable message on the calling screen
SAIF.Claims.Intake.Claimants Claimant Social Security numbers are written to the application trace log by ClaimantService.LogLookup when trace enabled="true" is set, which it is in the staging configuration Personally identifiable information accumulates in trace output that is retained on the web servers and readable by anyone with server access Remove the identifier from the trace call, disable tracing in every deployed configuration, and purge existing trace files
SAIF.Framework.Validation The library targets .NET Framework 4.5.2 while the application targets 4.8, and it is referenced by file path rather than as a package The version actually deployed depends on the build agent's file layout, so a validation fix can silently fail to reach production Retarget the library to 4.8, publish it as a versioned NuGet package, and replace the file reference with a package reference
SAIF.Claims.Intake.Triage Adjuster queue routing thresholds for injury severity are hard-coded as constants in TriageRouter Every routing change requires a code change, a full build, and an application deployment, so business changes wait on a release window Move the thresholds to configuration or a reference table read through the claims web service

Summary

Severity Count
CRITICAL 3
HIGH 5
Total 8

Sources

  • src/SAIF.Claims.Intake/Web.config
  • src/SAIF.Claims.Intake/SAIF.Claims.Intake.vbproj
  • src/SAIF.Claims.Intake/Claims/ClaimSubmissionCoordinator.vb
  • src/SAIF.Claims.Intake/Services/ClaimsServiceProxy.vb
  • src/SAIF.Claims.Intake/Services/ClaimSearchService.vb
  • src/SAIF.Claims.Intake/Claimants/ClaimantService.vb
  • src/SAIF.Claims.Intake/Triage/TriageRouter.vb