Tech debt¶

This page lists CRITICAL and HIGH findings only.

Critical¶

Field	Value
Finding	The Connections endpoints return complete connection strings, with embedded credentials, in the response body (by design)
Component	`ConnectionsController`
Impact	Any caller authorized for the resource, or any log or proxy that captures bodies, obtains database credentials
Recommended action	Restrict callers to named service identities, avoid logging response bodies, and plan a design that avoids returning secrets

Field	Value
Finding	The Admin endpoints return the raw `credentials` value, `user`, plaintext `pw` and `connectionString`, with no probe, cache or audit log (BR-DBC-023)
Component	`AdminController`
Impact	Credential disclosure with no audit trail
Recommended action	Remove the endpoints or add a separate administrative resource, mask the password and write an audit entry

Field	Value
Finding	The Admin endpoints share the retrieval resource, so least privilege is not applied (BR-DBC-025)
Component	`AdminController`, `ConnectionsController`
Impact	Any retrieval caller can also read raw credentials
Recommended action	Introduce a dedicated administrative resource

Field	Value
Finding	The caller's identity is never matched against the requested instance or user
Component	Controllers and `ConnectionManager`
Impact	An authorized caller can request any configured credential
Recommended action	Map callers to the instances and users they may request

Field	Value
Finding	Swagger JSON and UI are active in all environments and registered ahead of authentication
Component	`Startup`
Impact	The API surface is discoverable without authentication
Recommended action	Restrict Swagger to non-production or place it behind authentication

Field	Value
Finding	Error messages disclose the secure-setting key, the track name, server, instance and user names, and raw provider messages
Component	`ConnectionManager`
Impact	Information leakage that helps an attacker enumerate credentials and hosts
Recommended action	Return generic messages and keep detail in logs

Field	Value
Finding	`web.config` names the Visual Studio launcher, sets the environment to Development and enables detailed errors; whether publish transforms it is not determined from source**
Component	`web.config`
Impact	Detailed errors may be exposed if deployed unchanged
Recommended action	Remove the file or set production-safe values

Field	Value
Finding	The pipelines configure .NET SDK 8.x and 9.x while the project targets `net10.0`
Component	`.azdo/DBConnectionAPI` and `.azdo/DBConnectionAPI CI` variables
Impact	Builds can fail or use the wrong SDK
Recommended action	Set the SDK version to 10.x

Field	Value
Finding	The CI definition's `projectFile` references `CryptoAPI/CryptoAPI.csproj`, which does not exist in this repository
Component	`.azdo/DBConnectionAPI CI/variables/vars.yml`
Impact	The CI pipeline cannot build this service
Recommended action	Point `projectFile` at the DBConnectionAPI project

Note: Statements marked with ** could not be confirmed; treat as unknown until verified.