---
title: Application tech debt register
summary: Consolidated CRITICAL and HIGH tech debt findings from all library analyses.
status: draft
owner: <owner>
last_reviewed: 2026-08-21
---

# Application tech debt register

This page consolidates all CRITICAL and HIGH severity tech debt findings from all library analyses performed against Claims Legal.

## Critical findings

| Library | Finding | Impact | Recommended action |
| --- | --- | --- | --- |
| [SAIF.Business.Claim.Legal](../libraries/saif-business-claim-legal/overview.md) | `clsHearingLocation.ValidateState` and `clsOtherFirm.ValidateState` build SQL by concatenating the `State` value directly into the query text instead of using a bound parameter. | SQL injection risk in hearing-location and other-firm maintenance flows, which could allow unauthorized data disclosure or modification. | Replace string concatenation with bound parameters, add focused security tests, and review similar ad hoc validation queries for the same pattern. |

## High findings

| Library | Finding | Impact | Recommended action |
| --- | --- | --- | --- |
| Platform (application-wide) | The application is built on ASP.NET WebForms targeting .NET Framework and relies on IIS-hosted NTLM/Kerberos Windows authentication for all internal users; there is no portable, framework-independent authentication layer.* | Ties the application to Windows-domain-joined IIS hosting, blocking migration to modern cross-platform or cloud-native hosting models without a parallel authentication rework, and leaves the app dependent on legacy NTLM infrastructure with its known relay/downgrade weaknesses. | Plan a phased migration path (e.g., to ASP.NET Core with a modern identity provider) and, in the interim, harden NTLM configuration (disable NTLMv1, enforce channel binding) and document the authentication dependency for infrastructure teams. |
| [SAIF.Application.Claim](../libraries/saif-application-claim/overview.md) | `ClaimServices.HasOverrideAcess` is the only confidential-claim override path, but the repository analysis could not resolve the owning library or inspect the logic behind it. | The single mechanism that can bypass the conflict-claim access denial ([BR-APP-001](business-rules.md#br-app-001-confidential-claim-access-gating)) is undocumented, making its correctness and audit posture unverifiable. | Trace the dependency to its owning assembly, document the override rules, and add an explicit contract or wrapper interface in the application layer. |
| [SAIF.Application.Claim](../libraries/saif-application-claim/overview.md) | `CollateralHealthClaim` and `ClaimUserAccess.HealthIssueAccess` are declared, but `ClaimSecurity.CheckClaim` never consults them, so the resource key has no effect. | Health-issue claim access restrictions intended by the `CollateralHealthClaim` AD resource are not actually enforced, creating a false sense of security around health-issue claim data. | Align `ClaimSecurity.CheckClaim` with the intended health-issue resource check and add regression tests for health-issue claim access. |
| [SAIF.Presentation.Web.Controls.PopUps.Infragistics111](../libraries/saif-presentation-web-controls-popups-infragistics111/overview.md) | `ImageMovePopup.CheckImageSecurity` returns `True` for six system mail IDs without performing an AD authorization check. | A hard-coded allow-list bypasses centralized authorization for system mailbox image-move actions, making the access grant unauditable and inflexible to change. | Replace the hard-coded allow-list with an auditable service-account authorization path or an explicit centrally managed entitlement check. |
| [SAIF.Application](../libraries/saif-application/overview.md) | `ServiceResponse.ProcessException` re-reads `ex.InnerException` on each loop iteration instead of advancing through the current exception chain, creating an infinite-loop risk on nested exceptions. | A multi-level nested exception can cause the exception-processing loop to hang, potentially exhausting a request thread or worker process. | Fix the loop to advance through the current inner exception, add a unit test with a multi-level exception chain, and backfill coverage for service-response error handling. |
| [SAIF.Application](../libraries/saif-application/overview.md) | `UserAccess.CheckAccess` discards its computed result and provides no observable enforcement beyond cache warming. | Callers may believe `CheckAccess` performs an authorization gate when it does not, risking an unintended access-control gap wherever it is relied upon as an enforcement point. | Either remove the method and migrate callers to `HasAccess`, or change it to return a meaningful authorization outcome and add call-site tests. |
| [SAIF.Business.Policy](../libraries/saif-business-policy/overview.md) | `PolicyInformation.PolicyMinimumPremium` wraps the stored-procedure call in an empty `Catch` block and can silently return `0` when the lookup fails. | A failed premium lookup is indistinguishable from a genuine zero-premium result, risking incorrect downstream premium calculations without any visible error. | Replace the empty catch with structured error handling, log failures, and distinguish an actual zero premium from a lookup failure. |
| [SAIF.Services.Export](../libraries/saif-services-export/overview.md) | `ExportServices.GetCSV` skips null fields instead of emitting empty columns, which can create column-misaligned CSV output. | Exported assignment-list and other CSV files may have shifted columns whenever a null field is encountered, corrupting downstream consumption of the export ([Generate reports and PDF previews](operations/generate-reports-and-pdf-previews.md)). | Emit explicit empty fields for null values and add a regression test that verifies consistent column counts across rows. |
| [SAIF.Business.View.Policy](../libraries/saif-business-view-policy/overview.md) | `clsMCOCollection` and `clsPolicyMCOCollection` execute the same stored procedure with near-identical retrieval logic. | Duplicated retrieval logic risks the two code paths diverging over time, producing inconsistent results for what should be the same underlying data. | Consolidate the two collection paths behind one implementation or one shared retrieval helper to eliminate divergence risk. |
| [SAIF.Business.View.Policy](../libraries/saif-business-view-policy/overview.md) | `PolicyAssociations.vb` duplicates the newer association model implemented through `clsAssociationTypeCode` and `clsPolicyAssociationFactory`. | Maintaining two parallel association models increases maintenance burden and risks inconsistent policy-association data being returned depending on which path a caller uses. | Retire the legacy association path or formally designate one canonical association model and migrate consumers to it. |
| [SAIF.Application](../libraries/saif-application/overview.md) | The library declares two different `AppSecurityRole` enum types with the same members: `AppManagerBase.AppSecurityRole` and `SAIF.Application.AppSecurityRole`. | Ambiguity over which enum downstream consumers reference for security-role state risks type-mismatch bugs and inconsistent security-role handling across the application. | Remove the duplicate declaration or alias one canonical type, then update downstream references and serialization points to use a single enum. |
| [SAIF.Services.Printing](../libraries/saif-services-printing/overview.md) | `documentGeneratorServiceUrl`, `documentMSMQPath`, `idmFilePath`, and `sqlReportingServiceUrl` are required at runtime, but the library configs provide no local fallback or visible source for those values. | Missing or misconfigured environment values can cause silent or hard-to-diagnose report/PDF generation failures in production. | Publish an explicit configuration contract for the environment service, validate keys on startup, and surface missing-key failures with actionable diagnostics. |
| [SAIF.Business.Claim.Legal](../libraries/saif-business-claim-legal/overview.md) | `SAIF.Business.Claim.Legal` depends transitively on `BDS_USER`, `bdsDatabase`, and `BDS_DATABASENAME` through [SAIF.Business.View.Policy](../libraries/saif-business-view-policy/overview.md), but those keys are not declared in the library itself. | Undocumented transitive configuration dependencies risk deployment failures that are difficult to trace back to the missing SQL Server BDS keys. | Document the transitive configuration contract in deployment guidance and add startup validation in the host application for required BDS keys. |

## Summary

| Severity | Count |
| --- | --- |
| CRITICAL | 1 |
| HIGH | 13 |
| **Total** | 14 |

## Related documentation
- [Application index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Data model](data-model.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts.

## Sources
- `SAIF.Business.Claim.Legal/clsHearingLocation.vb`
- `SAIF.Business.Claim.Legal/clsOtherFirm.vb`
- `SAIF.Application.Claim/ClaimAppManager.vb`
- `SAIF.Application.Claim/ClaimSecurity.vb`
- `SAIF.Presentation.Web.Controls.PopUps.Infragistics111/ImageMovePopup.vb`
- `SAIF.Application/ServiceResponse.vb`
- `SAIF.Application/UserAccess.vb`
- `SAIF.Business.Policy/PolicyInformation.vb`
- `SAIF.Services.Export/ExportServices.vb`
- `SAIF.Business.View.Policy/clsMCOCollection.vb`
- `SAIF.Business.View.Policy/PolicyAssociations.vb`
- `SAIF.Application/AppManagerBase.vb`
- `SAIF.Application/Enums.vb`
- `SAIF.Services.Printing/Web.config`
- `Legal/Web.config`