---
title: Tech debt
summary: CRITICAL and HIGH severity findings from analysis.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-09-23
---

# Tech debt

This host carries no authorization construct of any kind across its eight operations, returns full server-side exception detail to every caller through a fault pipeline that is inferred* to be observational only, forwards job names and parameters downstream with no validation, and defaults to allowing any environment not explicitly listed in its allow/deny rules.

## CRITICAL

| Finding | Component | Impact | Recommended action |
| --- | --- | --- | --- |
| No authorization construct exists in this host's code — IIS is configured with both Windows Authentication and Anonymous Authentication enabled, and every operation's [access requirement](authentication-authorization.md#access-requirements-per-operation) is "None in code" | `UC4Service` | Any caller who can reach the endpoint anonymously can invoke any of the eight job-execution operations, each of which can trigger arbitrary downstream job execution via `UC4Client.ScheduleJob` | Add explicit caller-identity authorization to at least the job-execution operations, or document and enforce the intended network-boundary protection that anonymous access currently relies on |
| `includeExceptionDetailInFaults` is enabled in `Web.config` (alongside `customErrors mode="Off"` and `httpErrors errorMode="Detailed"`), so every unhandled exception — including stack traces and internal type names — is returned to the caller | `UC4Service`, `Web.config` | Any caller of any of the eight operations can observe internal exception detail on any unhandled failure; the applied `[LogErrorBehavior]` service behavior is inferred* to log without shaping the fault — its origin package could not be resolved from `packages.config`, so this could not be independently verified (see [Faults and error pipeline](faults.md)) | Set `includeExceptionDetailInFaults="false"` in the deployed configuration and introduce typed fault contracts so callers receive a controlled failure shape instead of raw exception detail |

## HIGH

| Finding | Component | Impact | Recommended action |
| --- | --- | --- | --- |
| Job names and parameter values are forwarded to the downstream scheduling service without format, length, or content validation beyond a null check on `jobName` | `UC4Service`, `Uc4Client` | Unvalidated values reach the downstream UC4 scheduling service unchecked; the space-validation check that would catch malformed job/parameter names ([BR-UC4-007](business-rules.md#br-uc4-007-job-and-parameter-names-must-not-contain-spaces-declared-not-enforced)) is declared in code but never called | Call `UC4Service.Validate` (or an equivalent check) before forwarding job name and parameter values downstream |
| An environment with no entry in the `uc4.rules` document is allowed by default, except environment `100`, which is blocked by default | `UC4Service` | A new or forgotten environment is unprotected until an explicit rule is added to `uc4.rules` (see [BR-UC4-002](business-rules.md#br-uc4-002-default-allow-for-unmatched-environment)) | Change the default posture to deny-by-default for unmatched environments, requiring an explicit allow rule before jobs can run |

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Activation and hosting](activation-hosting.md)
- [Operations](operations.md)
- [Faults and error pipeline](faults.md)
- [Authentication and authorization](authentication-authorization.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Operational runbook](operational-runbook.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources
- `src/WCF/SAIF.Services.WCF.UC4.Host/UC4Service.cs`
- `src/WCF/SAIF.Services.WCF.UC4.Host/Uc4Client.cs`
- `src/WCF/SAIF.Services.WCF.UC4.Host/Web.config`
- `src/WCF/SAIF.Services.WCF.UC4.Host/UC4JobRules.cs`