---
title: Tech debt
summary: CRITICAL and HIGH severity findings from analysis.
status: draft
owner: SAIF.Core documentation
last_reviewed: 2026-09-24
---

# Tech debt

`SMTP` is fully dead code from this repository's perspective: compiled into the shipped `SAIF.Services.Web.Proxies` assembly, `internal`, with no wrapper and no callers, targeting a QA-only host.

## CRITICAL

*(none identified)*

## HIGH

| Finding | Component | Impact | Recommended action |
| --- | --- | --- | --- |
| The proxy is compiled into the shipped assembly with no wrapper and no callers anywhere in this repository | `Services/SAIF.Services.Web.Proxies/Service References/SMTP/` | Dead code carried in the shipped package for no in-repository benefit | Confirm no external consumer needs it (unlikely, given the `internal` modifier and absence of `InternalsVisibleTo`); if confirmed unused, remove it |
| Its only configured endpoints target the QA host `webqa` over plain HTTP, and no production address exists anywhere in this repository | `Services/SAIF.Services.Web.Proxies/app.config:57-58` | If this proxy were ever wired up without updating the endpoint, it would silently send mail through a QA server, and the request would not be authenticated or encrypted | If the proxy is retained, add a production endpoint and require transport security before use |
| Two endpoints (`clsSAIFMessageSoap`, `clsSAIFMessageSoap12`) are declared for the same contract | `app.config:57-58` | A parameterless construction of the generated client would throw `InvalidOperationException` (ambiguous endpoint)* | If the proxy is retained, remove the unused SOAP 1.2 endpoint or document which one is intended for use |

## Related documentation
- [Client index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Contract](contract.md)
- [Operation map](operation-map.md)
- [Client reference](reference.md)
- [Consumption](consumption.md)
- [Dependencies](dependencies.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources
- `Services/SAIF.Services.Web.Proxies/Service References/SMTP/`
- `Services/SAIF.Services.Web.Proxies/app.config`