Tech debt

ID	Severity	Finding	Evidence	Suggested remediation
TD-CR-01	Medium	Dead generated proxy: ~900 KB of generated code (Reference.cs), 8 metadata files, and 35 .datasource files are compiled and shipped in SAIF.Services.Web.Proxies.dll with no in-repo consumer	Services/SAIF.Services.Web.Proxies/Service References/CallRex/	Remove the service reference if no consumer is planned, or document the intended external consumer that justifies keeping it
TD-CR-02	Low	Unused vendor assembly references: CallRex.Utilities.dll and CallrexAPIUtilities.dll are referenced by the project but not imported by any source file	SAIF.Services.Web.Proxies.csproj:57-62; Libs/ThirdParty/CallRex/	Remove the references if unused, or confirm a runtime need (e.g., reflection-based use)
TD-CR-03	Medium	Ambiguous configuration: two endpoints (CustomBinding_IClientService, CustomBinding_IClientService1) share the same contract with no endpoint name distinction a caller must supply; IClientAccessPolicy has no endpoint at all	app.config:61-70; service.wsdl:1753,3315-3330	Consolidate to one endpoint per intended use case, or document why two coexist; add an IClientAccessPolicy endpoint if that contract is ever needed
TD-CR-04	Low	No timeouts configured on CustomBinding_IClientService; framework defaults (1 min send/open/close, 10 min receive) would silently apply if the proxy were ever used	app.config:34-37	Set explicit timeouts before any caller is introduced
TD-CR-05	Low	Stale test namespace: AudioVideoTests is namespaced SAIF.Services.Tests.CallRex but depends on an undefined CallRecordingSystem type and is permanently skipped	Tests/SAIF.Services.Tests/AudioVideo/AudioVideoTests.cs:13,21,35,83,132,161	Delete or rewrite the test; the namespace is misleading since it does not exercise this proxy
SEC-CR-01	High	Transport is plain HTTP (http://callrexprod:8002/ClientService, http://callrexprod:8002/ClientServiceBasic); NTLM authenticates the caller, but message bodies are not encrypted in transit	app.config:61,66	Require HTTPS/TLS transport before any caller is introduced, given the sensitive operations below
SEC-CR-02	High	Sensitive operations are present on the contract but unused: Login(username, password), ChangePassword(oldPassword, newPassword), SetNewEncryptionKey(username1, password1, username2, password2, revokeExistingKeys, enableEncryption), UpdateUser(user, passwordChanged) carry credentials in message bodies over HTTP	service.xsd element definitions for these operations	If a caller is ever introduced, ensure TLS transport and avoid logging these message bodies

Config applicability gap

The app.config of a class library that ships only DLL/PDB is not loaded by package consumers*, so any external SAIF.SAIFCode.Core consumer that constructs these clients would need to supply its own <client> configuration — the two endpoints documented here would not apply automatically.

Related documentation

• Client index
• Overview
• Architecture
• Contract
• Operation map
• Client reference
• Consumption
• Dependencies

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

• Services/SAIF.Services.Web.Proxies/app.config
• Services/SAIF.Services.Web.Proxies/SAIF.Services.Web.Proxies.csproj
• Services/SAIF.Services.Web.Proxies/Service References/CallRex/service.wsdl
• Services/SAIF.Services.Web.Proxies/Service References/CallRex/service.xsd
• Tests/SAIF.Services.Tests/AudioVideo/AudioVideoTests.cs
• Libs/ThirdParty/CallRex/CallRex.Utilities.dll
• Libs/ThirdParty/CallRex/CallrexAPIUtilities.dll