---
title: Tech debt
summary: Severity-grouped register of security, maintainability and platform issues in the ClaimBillEntry application, including the NTLM authentication finding.
status: draft
owner: Claims
last_reviewed: 2026-09-30
---

# Tech debt

This register lists six high-severity items and a set of lower-severity items found in the ClaimBillEntry application, including one item inherited from the consumed `SAIF.Services` assembly. No item is rated critical.

## Summary

| Severity | Count |
| --- | --- |
| Critical | 0 |
| High | 6 |
| Lower severity (additional items) | 21 |
| Total | 27 |

## High severity

### TD-001 NTLM authentication dependency

The application relies on IIS Windows authentication, which negotiates NTLM or Kerberos, with anonymous access disabled (`Pipelines/build-vars.yml:20-27`). NTLM is a legacy protocol with known relay and credential-exposure weaknesses. **Remediation:** move to OpenID Connect or OAuth 2.0 with a modern identity provider.

### TD-002 No anti-forgery protection and data deletion through GET

POST actions such as `Entry/SaveBill`, `Entry/SubmitBill`, `Entry/SendPendBill` and `Entry/DiscardBill` have no anti-forgery validation (`ClaimBillEntry/Controllers/EntryController.cs:108-167`). `DiagnosisGrid/ClearDiagnosesCodes` and `ProcedureGrid/ClearProcedureCodes` delete data through GET requests (`ClaimBillEntry/Controllers/DiagnosisGridController.cs:108`, `ClaimBillEntry/Controllers/ProcedureGridController.cs:104`). See [Hosted endpoints](hosted-endpoints.md). **Remediation:** add anti-forgery tokens and change deletions to POST.

### TD-003 Authorization enforced on the client or missing

The `CBEDiscardBill` permission only hides the Discard button; `Entry/DiscardBill` does not check it ([BR-SCR-006](business-rules.md#br-scr-006-discard-permission-is-enforced-client-side-only), `ClaimBillEntry/Controllers/EntryController.cs:159-167,209`). The grid, provider and lookup controllers carry no `SaifAuthorize` role check, so any authenticated Windows user can call them. **Remediation:** check the permission in the action and apply role attributes to every controller.

### TD-004 Insecure base Web.config settings

`customErrors` is `Off`, `compilation debug` is `true`, Glimpse is on in the base file, `validateRequest` is `false` and `requestValidationMode` is `2.0` (`ClaimBillEntry/Web.config:30-32`, `:381-385`, `ClaimBillEntry/Views/Web.config:29`). The Release transform removes debug and turns Glimpse off only for release builds. See [Configuration](configuration.md). **Remediation:** make secure values the base defaults.

### TD-005 Unencoded HTML in service preview

`BuildServicePreviewHtml` builds HTML without encoding and the `PreviewHtmlString` property allows HTML (`ClaimBillEntry/Controllers/ServiceGridController.cs:159-228`, `ClaimBillEntry/ViewModels/Entry/ServiceViewModel.cs:49`). Combined with disabled request validation this is a cross-site scripting risk. **Remediation:** encode every value placed in the HTML.

### TD-006 Outdated platform

The application targets .NET Framework 4.6.x, jQuery 1.9.1 and Kendo UI 2018.2.620 (`ClaimBillEntry/ClaimBillEntry.csproj:16`, `:114-115`, `ClaimBillEntry/packages.config:17`). These versions are out of vendor support. **Remediation:** plan upgrades of the framework and client libraries. See [Dependencies](dependencies.md).

## Additional items

| Item | Detail | Source |
| --- | --- | --- |
| Unfiltered bill search results (inherited from `SAIF.Services`) | `SearchController`'s search action calls `IBillQueryService.GetBillEntryBillsByCriteria(BillEntrySearchCriteria)` in the consumed `SAIF.SAIFCode.Core` package (`SAIF.Services` assembly). The package's own security-authorization findings record this method as returning unfiltered bills (SEC-01)† — it applies neither the local conflict-claim check that `EntryController.GetBill` performs (`UserHasAccessToClaim` → `IsConflictClaim` + `IsAuthorized("ConflictClaim")`) nor the package-computed `HasConflictAccess` flag that `BaseController.CheckSecurity`† separately consumes ([SVC-BR-SEC-01](business-rules.md#svc-br-sec-01-conflict-and-secure-claim-access-formulas)). This is an inherited risk surfaced through ClaimBillEntry's Search screen, not a defect introduced by ClaimBillEntry code. Cross-reference: [SVC-BR-SEC-01](business-rules.md#svc-br-sec-01-conflict-and-secure-claim-access-formulas) (the `ClaimSecurityService` pattern that `GetBillEntryBillsByCriteria` apparently does not apply), [BR-SCR-013](business-rules.md#br-scr-013-search-requires-qualifying-criteria) (search requires qualifying criteria — a distinct, already-documented screen rule that does not address this filtering gap) | `ClaimBillEntry/Controllers/SearchController.cs`; `SAIF.SAIFCode.Core` package (`SAIF.Services` assembly) security-authorization findings (SEC-01) |
| Unattributed endpoints | `Entry.GetDefaultAssignedToId` and `Provider.ShowProviderGrid` are not called by any screen** | `ClaimBillEntry/Controllers/EntryController.cs:170`, `ClaimBillEntry/Controllers/ProviderController.cs:39` |
| Dead actions | `NoteGrid.Editing_Popup` and `ServiceGrid.Editing_Popup` are not used | `ClaimBillEntry/Controllers/NoteGridController.cs`, `ClaimBillEntry/Controllers/ServiceGridController.cs` |
| Uncompiled ViewModels | Seven files are not compiled: `EntryDetailViewModel`, `EntryHeaderViewModel`, the root `EntryViewModel`, `InboxDetailViewModel`, `SearchDetailViewModel`, `SearchFilterViewModel` and the root `SearchViewModel` | `ClaimBillEntry/ClaimBillEntry.csproj` |
| Commented-out security policy | `GlimpseSecurityPolicy.cs` is not compiled and fully commented out | `ClaimBillEntry/GlimpseSecurityPolicy.cs` |
| Unused ViewModels | `InboxFilterViewModel` and `BillHeaderViewModel` are unused | `ClaimBillEntry/ViewModels/Inbox/InboxFilterViewModel.cs` |
| Inactive validators | `InboxFilterValidator` and `SearchFilterValidator` never run | [Business rules](business-rules.md#rules-not-reachable-from-this-application) |
| Empty editor templates | Note category and note type editor templates appear unpopulated* | `ClaimBillEntry/Views/Shared/EditorTemplates` |
| Malformed URL | `Url.Action(" SavePreferences")` and `Url.Action(" ClearPreferences")` have a leading space in the search criteria partial | `ClaimBillEntry/Views/Search/_SearchCriteria.cshtml:62,65` |
| Preference actions on every controller | `SavePreferences` and `ClearPreferences` are routable on every derived controller | `ClaimBillEntry/Controllers/BaseController.cs:50,70` |
| Unused injected service | `IBillEntryService` is injected into `ServiceGridController` but unused | `ClaimBillEntry/Controllers/ServiceGridController.cs` |
| Unused HttpClient | An `HttpClient` for `cc.ccclaimdataapiurl` is created and never registered | `SAIF.DependencyMaps.Web.ClaimBillEntry/DependencyMap.cs:47-49` |
| Commented-out registration | `RegisterInformationServices` is commented out | `SAIF.DependencyMaps.Web.ClaimBillEntry/DependencyMap.cs:75` |
| Inconsistent lifetimes | Overpayment, location, employee and policy providers use a different lifetime from the other providers | `SAIF.DependencyMaps.Web.ClaimBillEntry/DependencyMap.cs:97,100,103,129-131` |
| Uncompiled facade | `IApplicationDependencies` is not compiled | `SAIF.DependencyMaps.Web.ClaimBillEntry/IApplicationDependencies.cs` |
| Web API with no controllers | Web API is registered with no ApiController, and `RegisterAllAreas` runs with no areas | `ClaimBillEntry/Global.asax.cs:17,20` |
| Version mismatches | Project targets 4.6.2 while `Web.config` declares 4.6.1; MVC package 5.2.7 versus referenced assembly 5.2.6.0 | `ClaimBillEntry/ClaimBillEntry.csproj`, `ClaimBillEntry/Web.config` |
| Hard-coded virtual directory | Scripts hard-code `/ClaimBillEntry/` | `ClaimBillEntry/js/ClaimBillEntry.entry.js:219` |
| Session coupling | Inbox and send or pend behavior depends on Session values | `ClaimBillEntry/Controllers/InboxController.cs`, `ClaimBillEntry/Controllers/EntryController.cs:195` |
| Unused packages | Seven of fourteen internal packages are not consumed directly; transitive use was not traced** | [Dependencies](dependencies.md) |
| Stray code | Stray usings and a "not sure why" comment | `ClaimBillEntry/Views/Entry/EditorTemplates/_AddService.cshtml:6-7` |

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [Data model](data-model.md)
- [Hosted endpoints](hosted-endpoints.md)
- [Screen catalog](../screens/index.md)

> **Note:** Statements marked with `†` are derived from dependency library
> documentation via the Legends CLI. Statements marked with `*` were inferred
> from code structure or contextual evidence. Statements marked with `**` could
> not be confirmed; treat as unknown until verified.

## Sources
- Pipelines/build-vars.yml
- ClaimBillEntry/Web.config
- ClaimBillEntry/Views/Web.config
- ClaimBillEntry/ClaimBillEntry.csproj
- ClaimBillEntry/packages.config
- ClaimBillEntry/Controllers/EntryController.cs
- ClaimBillEntry/Controllers/DiagnosisGridController.cs
- ClaimBillEntry/Controllers/ProcedureGridController.cs
- ClaimBillEntry/Controllers/ServiceGridController.cs
- ClaimBillEntry/Controllers/BaseController.cs
- ClaimBillEntry/ViewModels/Entry/ServiceViewModel.cs
- ClaimBillEntry/Views/Search/_SearchCriteria.cshtml
- SAIF.DependencyMaps.Web.ClaimBillEntry/DependencyMap.cs