Tech debt

The two called operations return database connection strings, including credentials, over a binding with no transport security configured in code and no client credentials, with no retry, timeout, or fault-safe disposal at either call site. The runtime endpoint address is unresolved from repository configuration, so whether the wire transport is HTTP or HTTPS cannot be confirmed from this repository.

CRITICAL

Finding	Component	Impact	Recommended action
GetODPConnectString and GetSQLConnectString return full database connection strings, which almost certainly embed a user id and password, over a BasicHttpBinding() constructed with no security mode set — its default, BasicHttpSecurityMode.None — and no client credentials; the runtime endpoint address (and therefore the actual wire transport, HTTP or HTTPS) is unresolved from repository configuration, see Architecture	DbConnectionServiceProxy (Services/SAIF.Services.Web.Proxies/Legacy/DbConnectionsServiceProxy.cs:17-20,31,45)	A credential-bearing connection string is exposed in cleartext to any party able to observe the network path, if the unresolved runtime endpoint is HTTP	Not prescribed — see the skill's no-remediation rule

HIGH

Finding	Component	Impact	Recommended action
The dbconnectionserviceurl endpoint address is unresolved from any repository configuration file; only a unit-test mock literal exists	Services/SAIF.Services.Common/DbConnectionService.cs:21	The runtime target of this proxy cannot be confirmed by reading this repository	Not prescribed
No retry, no explicit timeout, and no cancellation exist at either call site	DbConnectionsServiceProxy.cs:25-31,38-45	Both calls are synchronous and blocking; a slow or unreachable remote service blocks the calling thread for up to the default binding timeout	Not prescribed
Dispose() calls Close() with no Abort() fallback on a faulted ClientBase<T>	DbConnectionsServiceProxy.cs:61-68	Close() on a faulted channel throws CommunicationObjectFaultedException, masking the original failure	Not prescribed
One ConnectInfoSoapClient is created per DbConnectionServiceProxy and reused for the owner's lifetime	DbConnectionsServiceProxy.cs:17-20; Services/SAIF.Services.Common/DbConnectionService.cs:21	After any fault, every later call on that instance fails until the owner is disposed and recreated*	Not prescribed

Related documentation

• Client index
• Overview
• Architecture
• Contract
• Operation map
• Client reference
• Consumption
• Dependencies
• Business rules

Note: Statements marked with * were inferred from code structure or contextual evidence.

Sources

• Services/SAIF.Services.Web.Proxies/Legacy/DbConnectionsServiceProxy.cs
• Services/SAIF.Services.Common/DbConnectionService.cs