---
title: Tech debt
summary: CRITICAL and HIGH severity findings from analysis.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-09-22
---

# Tech debt

This proxy carries no retry, timeout, or cancellation support at either call site, disposes a potentially faulted channel with no `Abort()` fallback, and coexists with two stale configured endpoint declarations that are never consulted at run time.

## CRITICAL

| Finding | Component | Impact | Recommended action |
| --- | --- | --- | --- |
| `MaxReceivedMessageSize`, `MaxBufferSize`, and `ReaderQuotas.MaxArrayLength` are all set to `int.MaxValue` | `SAIF.Services.WCF.Services.LegacyProxies.FaxServiceProxy` (`src\WCF\SAIF.Services.WCF.Host\Services\LegacyProxies\FaxServiceProxy.cs:19-24`) | Removes the guard that protects the process from an oversized response from `` `FaxService`† `` | Set explicit, bounded quotas sized to the largest legitimate fax response |

## HIGH

| Finding | Component | Impact | Recommended action |
| --- | --- | --- | --- |
| No retry policy at either call site | `FaxServiceProxy.SendFax` and `FaxService.SendFax` (`src\WCF\SAIF.Services.WCF.Host\Services\LegacyProxies\FaxServiceProxy.cs:41`; `src\WCF\SAIF.Services.WCF.Host\Services\FaxService.cs:42`) | Any transient failure of `` `FaxService`† `` surfaces directly to the caller of the hosted `FaxService.SendFax` operation | Add a retry policy with backoff around the outbound `Send` call, scoped to transient fault types |
| No timeout configured on the code-constructed binding or the unreferenced configured binding | `src\WCF\SAIF.Services.WCF.Host\Services\LegacyProxies\FaxServiceProxy.cs:17-27`; `Web.config:40` | The call inherits the WCF `BasicHttpBinding` transport default rather than a stated intent, so a hung remote service blocks the calling request indefinitely | Set explicit `SendTimeout`/`OpenTimeout`/`CloseTimeout` values on the code-constructed binding |
| No cancellation support at the call site | `src\WCF\SAIF.Services.WCF.Host\Services\LegacyProxies\FaxServiceProxy.cs:41` | A caller cannot abandon an in-flight `Send` call | Not applicable to synchronous `ClientBase<T>` calls without adopting the async overloads; document the limitation if retained |
| `Close()` with no `Abort()` fallback on disposal | `FaxServiceProxy.Dispose(bool)` (`src\WCF\SAIF.Services.WCF.Host\Services\LegacyProxies\FaxServiceProxy.cs:55-63`) | `ClientBase<T>.Close()` on a faulted channel throws, so a failed `Send` can produce a second exception during disposal that masks the original failure | Catch a faulted-channel exception from `Close()` and call `Abort()` instead |
| Two stale configured endpoint declarations coexist with the authoritative code-resolved address | `Web.config:15`, `Web.Base.config:14` (`http://api.saif.com/webservices/SAIFFaxService/faxservice.asmx`); `Reference.svcmap`/`faxservice.disco` (`http://websvcprod/webservices/SAIFFaxService/faxservice.asmx`, generation-time only) | A maintainer reading `Web.config` sees an endpoint that is never actually used, and the true runtime address cannot be read from this repository at all | Remove the unreferenced `<client><endpoint>` and `<binding>` elements, or document plainly that they are dead configuration |
| No try/catch around either call to the proxy | `FaxServiceProxy.SendFax` (`src\WCF\SAIF.Services.WCF.Host\Services\LegacyProxies\FaxServiceProxy.cs:41`); `FaxService.SendFax` (`src\WCF\SAIF.Services.WCF.Host\Services\FaxService.cs:42`) | `FaultException`, `FaultException<T>`, `CommunicationException`, and `TimeoutException` all escape to the caller untouched, and the `foreach` in `FaxService.SendFax` aborts on the first failing recipient, leaving `fileService.DeleteFile(fullFilePath)` on `src\WCF\SAIF.Services.WCF.Host\Services\FaxService.cs:45` unreached — the temporary fax file leaks on any outbound failure | Wrap the call in a try/finally that guarantees temp-file cleanup regardless of outcome, and decide explicit handling for each fault/exception type |
| Runtime endpoint literal key is unresolvable in this repository | `EnvironmentConfigKeys.FaxSoapServiceUrl` (declared in the referenced `SAIF.Services.Common` package, not under `src\`) | Neither the key name nor its per-environment values can be verified or audited from this repository | Document the key and its per-environment values in the owning package's own documentation, or surface it in this repository's configuration reference |

## Related documentation
- [Client index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Contract](contract.md)
- [Operation map](operation-map.md)
- [Client reference](reference.md)
- [Consumption](consumption.md)
- [Dependencies](dependencies.md)

> **Note:** Statements marked with `†` are derived from dependency library documentation via the Legends CLI. They describe inherited behavior from the indicated origin library and should be verified if the dependency version changes.

## Sources
- `src\WCF\SAIF.Services.WCF.Host\Services\LegacyProxies\FaxServiceProxy.cs`
- `src\WCF\SAIF.Services.WCF.Host\Services\FaxService.cs`
- `src\WCF\SAIF.Services.WCF.Host\Web.config`
- `src\WCF\SAIF.Services.WCF.Host\Web.Base.config`
- `src\WCF\SAIF.Services.WCF.Host\Service References\Legacy.Fax\Reference.svcmap`
- `src\WCF\SAIF.Services.WCF.Host\Service References\Legacy.Fax\faxservice.disco`