---
title: Tech debt
summary: Critical and high severity findings for DBConnectionAPI with impact and recommended action.
status: draft
owner: Architecture
last_reviewed: 2026-10-09
---

# Tech debt

This page lists CRITICAL and HIGH findings only.

## Critical

### SEC-01 Connection strings with credentials returned in responses

| Field | Value |
| --- | --- |
| Finding | The Connections endpoints return complete connection strings, with embedded credentials, in the response body (by design) |
| Component | `ConnectionsController` |
| Impact | Any caller authorized for the resource, or any log or proxy that captures bodies, obtains database credentials |
| Recommended action | Restrict callers to named service identities, avoid logging response bodies, and plan a design that avoids returning secrets |

### SEC-02 Admin endpoints disclose plaintext passwords

| Field | Value |
| --- | --- |
| Finding | The Admin endpoints return the raw `credentials` value, `user`, plaintext `pw` and `connectionString`, with no probe, cache or audit log ([BR-DBC-023](business-rules.md#br-dbc-023-admin-inspection-discloses-raw-credentials)) |
| Component | `AdminController` |
| Impact | Credential disclosure with no audit trail |
| Recommended action | Remove the endpoints or add a separate administrative resource, mask the password and write an audit entry |

## High

### SEC-03 No admin separation

| Field | Value |
| --- | --- |
| Finding | The Admin endpoints share the retrieval resource, so least privilege is not applied ([BR-DBC-025](business-rules.md#br-dbc-025-resource-authorization-on-every-endpoint)) |
| Component | `AdminController`, `ConnectionsController` |
| Impact | Any retrieval caller can also read raw credentials |
| Recommended action | Introduce a dedicated administrative resource |

### SEC-04 No data-level authorization

| Field | Value |
| --- | --- |
| Finding | The caller's identity is never matched against the requested instance or user |
| Component | Controllers and `ConnectionManager` |
| Impact | An authorized caller can request any configured credential |
| Recommended action | Map callers to the instances and users they may request |

### SEC-05 Swagger exposed in every environment

| Field | Value |
| --- | --- |
| Finding | Swagger JSON and UI are active in all environments and registered ahead of authentication |
| Component | `Startup` |
| Impact | The API surface is discoverable without authentication |
| Recommended action | Restrict Swagger to non-production or place it behind authentication |

### SEC-06 Error messages disclose internals

| Field | Value |
| --- | --- |
| Finding | Error messages disclose the secure-setting key, the track name, server, instance and user names, and raw provider messages |
| Component | `ConnectionManager` |
| Impact | Information leakage that helps an attacker enumerate credentials and hosts |
| Recommended action | Return generic messages and keep detail in logs |

### SEC-09 Developer web.config

| Field | Value |
| --- | --- |
| Finding | `web.config` names the Visual Studio launcher, sets the environment to Development and enables detailed errors; whether publish transforms it is not determined from source** |
| Component | `web.config` |
| Impact | Detailed errors may be exposed if deployed unchanged |
| Recommended action | Remove the file or set production-safe values |

### TD-01 Pipeline SDK version does not match net10.0

| Field | Value |
| --- | --- |
| Finding | The pipelines configure .NET SDK 8.x and 9.x while the project targets `net10.0` |
| Component | `.azdo/DBConnectionAPI` and `.azdo/DBConnectionAPI CI` variables |
| Impact | Builds can fail or use the wrong SDK |
| Recommended action | Set the SDK version to 10.x |

### TD-02 CI pipeline project file points at a missing project

| Field | Value |
| --- | --- |
| Finding | The CI definition's `projectFile` references `CryptoAPI/CryptoAPI.csproj`, which does not exist in this repository |
| Component | `.azdo/DBConnectionAPI CI/variables/vars.yml` |
| Impact | The CI pipeline cannot build this service |
| Recommended action | Point `projectFile` at the DBConnectionAPI project |

> **Note:** Statements marked with `**` could not be confirmed; treat as unknown until verified.

## Related documentation
- [API index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Hosting pipeline](hosting-pipeline.md)
- [Endpoints](endpoints.md)
- [Authentication and authorization](authentication-authorization.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Data model](data-model.md)
- [Operational runbook](operational-runbook.md)

## Sources
- DBConnectionAPI/DBConnectionAPI/Controllers/AdminController.cs
- DBConnectionAPI/DBConnectionAPI/Controllers/ConnectionsController.cs
- DBConnectionAPI/DBConnectionAPI/Services/ConnectionManager.cs
- DBConnectionAPI/DBConnectionAPI/Startup.cs
- DBConnectionAPI/DBConnectionAPI/web.config
- .azdo/DBConnectionAPI/variables/vars.yml
- .azdo/DBConnectionAPI CI/variables/vars.yml