---
title: Tech debt
summary: CRITICAL and HIGH severity findings from analysis.
status: draft
owner: Not determined from source
last_reviewed: 2026-09-17
library: PdfAPI
reference_type: embedded
---

# Tech debt

PdfAPI's most significant technical debt is the absence of any authorization construct combined with write-capable, unauthenticated-by-default endpoints and framework exception detail produced before the response envelope, whose final client-visible shape is unknown**.
Secondary findings cover hard-coded environment-varying values, a legacy pre-release package dependency, dead configuration/code, and an unguarded configuration parse.

## CRITICAL

| Finding | Component | Impact | Recommended action |
| --- | --- | --- | --- |
| No authorization construct exists anywhere in application code (`[Authorize]`, `[SaifAuthorize]`, `IsInRole`, or any equivalent — zero matches across the solution closure) | All six controllers (13 endpoints) | Any caller that can reach the host can invoke every endpoint, including document conversion, merge, and extraction operations that write tracking records and consume compute resources; combined with IIS anonymous authentication (`IISAnonymousAuth: true` in `Pipelines\build-vars.yml`), the service is reachable without any authenticated identity | Introduce an authorization mechanism (e.g. `[SaifAuthorize]` or equivalent) on all controllers, or document and formally accept the network-perimeter-only trust model |
| `config.IncludeErrorDetailPolicy = IncludeErrorDetailPolicy.Always;` produces full framework exception detail (message, type, stack trace) before `ApiResponseHandler` runs, in every environment, not only locally; the final client-visible envelope is unknown** (see [Endpoints: Error response shape](endpoints.md#error-response-shape)) | `PdfAPI\App_Start\WebApiConfig.cs` | Internal implementation details, file paths, and potentially sensitive data are exposed to any caller who triggers an unhandled exception (e.g. any of the eight endpoints with no `try`/`catch` (`InfoController`'s seven actions, `ApiInfoController`'s one action)) | Set `IncludeErrorDetailPolicy` to `LocalOnly` or a configuration-driven value scoped to non-production environments |

## HIGH

| Finding | Component | Impact | Recommended action |
| --- | --- | --- | --- |
| Syncfusion license key is a hard-coded string literal, not retrieved via `GetSecureConfigSetting` | `PdfApi.SyncFusionCore\LicenseHelper.cs` | Vendor license key is committed to source control and visible to anyone with repository access | Move the license key to secure configuration and retrieve it via `IEnvironmentService.GetSecureConfigSetting` |
| SMTP host `"mail.saif.com"` is hard-coded | `PdfAPI\Services\PdfService.cs:140` | An environment-varying infrastructure endpoint cannot be changed without a code change and redeploy | Move the SMTP host to Environment API configuration alongside the sender/recipient addresses |
| Oracle schema `"IMG"` is a hard-coded literal at the composition-root call site | `PdfAPI\App_Start\IocConfig.cs:19` | Changing the target schema requires a code change and redeploy rather than a configuration change | Move the schema argument to Environment API configuration |
| `ApplicationHost = entdev01` (a development host name) is committed to the deployable `Web.config`, with no active `Web.Debug.config`/`Web.Release.config` XDT transform overriding it | `PdfAPI\Web.config:12` | A misconfigured or bypassed deployment pipeline could leave a production deployment pointed at the development environment tier | Add live XDT transforms per environment, or otherwise verify the deployment pipeline reliably overrides this value in every target environment |
| `compilation/@debug = true` is committed to `Web.config` with no active transform to disable it in release deployments | `PdfAPI\Web.config:24` | Debug-mode compilation can degrade performance and expose additional diagnostic information in production | Add a release transform that sets `debug="false"`, or verify the deployment pipeline overrides it |
| Legacy `SAIF.Web.Mvc 1.0.16263.1-alpha` (a 2016 pre-release package) is referenced in `packages.config` alongside a `SAIF.Framework.Web.Mvc` assembly reference and the current `SAIF.Framework.*` 2.0.22xxx package family | `PdfAPI\packages.config`, `PdfAPI\PdfAPI.csproj` | The MVC extension surface (including `RegisterCommonDependencies`) is sourced from an unsupported pre-release package while the rest of the stack is current, creating version-compatibility risk | Replace the `SAIF.Web.Mvc` alpha package reference with the current `SAIF.Framework.Web.Mvc` package |
| `pdfApi.ErrorsToRetry` is parsed unguarded: `errorsToRetryConfig.Split(',').Select(x => long.Parse(x))` | `PdfAPI\Services\ActivePdf\ActivePdfService.cs:20` | A null, empty, or non-numeric configuration value throws during `ActivePdfService` construction, failing every request routed to the ActivePDF processor | Add validation/guarding around the parse, with a clear configuration error rather than an unhandled `FormatException` |
| `PdfSettings` (`PdfAPI.Core\Services\PdfSettings.cs`) is declared but never constructed anywhere in `PdfAPI\`; the service layer duplicates its key literals by reading `IEnvironmentService` directly | `PdfAPI.Core\Services\PdfSettings.cs` | Dead code maintained in parallel with the equivalent inline reads; the declared-only keys `pdfdatadirectory` and `pdfapi.url` are red herrings for anyone auditing configuration | Remove `PdfSettings` if genuinely unused, or consolidate configuration reads through it if it is intended for future use |
| A dead `IEnvironmentService` constructor parameter is accepted by five controllers | `PdfAPI\Controllers\v1\*.cs` (five of six controllers) | Unused constructor dependencies increase composition-root coupling and obscure which controllers actually need `IEnvironmentService` | Remove the unused parameter from controllers that do not read `IEnvironmentService` directly |
| Stray `Console.WriteLine(result.ToString())` at the end of `SyncfusionPdfService.FinalizeResult` | `PdfAPI\Services\Syncfusion\SyncfusionPdfService.cs` | Console output from an IIS-hosted service has no defined destination and provides no operational value; may also incur a minor performance cost under load | Remove the statement or replace it with a structured `ILogService.TraceDebug` call |
| Swagger UI is enabled with entirely default options (`EnableSwaggerUi(c => { /* all comments */ })`), with no `BasicAuth`/`ApiKey`/`OAuth2` protection configured | `PdfAPI\App_Start\SwaggerConfig.cs` | The API's full documented surface (including the `v1/info/*` byte-array endpoints) is discoverable by anyone who can reach the host, compounding the no-authorization finding above | Decide whether Swagger UI should be exposed in production, and if so, add access controls consistent with the rest of the service |

## Related documentation
- [API index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Endpoints](endpoints.md)
- [Authentication and authorization](authentication-authorization.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Data model](data-model.md)
- [Operational runbook](operational-runbook.md)

> **Note:** Statements marked with `**` could not be confirmed; treat as unknown until verified.

## Sources
- PdfAPI\App_Start\WebApiConfig.cs
- PdfAPI\App_Start\IocConfig.cs
- PdfAPI\App_Start\SwaggerConfig.cs
- PdfAPI\Web.config
- PdfAPI\packages.config
- PdfAPI\PdfAPI.csproj
- PdfAPI\Services\PdfService.cs
- PdfAPI\Services\ActivePdf\ActivePdfService.cs
- PdfAPI\Services\Syncfusion\SyncfusionPdfService.cs
- PdfAPI.Core\Services\PdfSettings.cs
- PdfApi.SyncFusionCore\LicenseHelper.cs
- Pipelines\build-vars.yml