Code Reviews
Comprehensive, per-module code reviews of the ScadaLink codebase. Each module (one
buildable project under src/) has its own folder containing a findings.md. This
README is the aggregated index — the single place to see all outstanding work.
Generated by
regen-readme.pyfrom the per-modulefindings.mdfiles. Do not edit by hand — edit the findings files and re-run the script.
How it works
- Reviews are performed one module at a time against a fixed checklist.
- Every finding is recorded in the module's
findings.mdwith a severity and status. - Findings are never deleted — they are closed by changing their status, keeping a full audit trail.
- This README aggregates every pending finding (
Open/In Progress) across all modules.
See REVIEW-PROCESS.md for the full procedure: the review checklist, severity definitions, finding format, and how to mark items resolved.
Layout
code-reviews/
├── README.md # this file — process overview + pending findings
├── REVIEW-PROCESS.md # how to perform a review and track findings
├── regen-readme.py # regenerates this README from the findings files
├── _template/findings.md # copy-this template for a module review
└── <Module>/findings.md # one folder per src/ project
Baseline review — 2026-05-16
All 19 modules were reviewed at commit 9c60592 (241 findings: 6 Critical, 46 High,
100 Medium, 89 Low). The tables below track what remains open as findings are
resolved and re-triaged; findings discovered after the baseline are appended to their
module file and counted in Total.
| Severity | Open findings |
|---|---|
| Critical | 0 |
| High | 8 |
| Medium | 26 |
| Low | 32 |
| Total | 66 |
Module Status
| Module | Last reviewed | Commit | Open (C/H/M/L) | Open | Total |
|---|---|---|---|---|---|
| CLI | 2026-05-16 | 9c60592 |
0/0/1/2 | 3 | 16 |
| CentralUI | 2026-05-16 | 9c60592 |
0/1/2/3 | 6 | 25 |
| ClusterInfrastructure | 2026-05-16 | 9c60592 |
0/0/1/1 | 2 | 10 |
| Commons | 2026-05-16 | 9c60592 |
0/0/0/2 | 2 | 14 |
| Communication | 2026-05-16 | 9c60592 |
0/1/1/2 | 4 | 15 |
| ConfigurationDatabase | 2026-05-16 | 9c60592 |
0/0/2/1 | 3 | 14 |
| DataConnectionLayer | 2026-05-16 | 9c60592 |
0/1/2/1 | 4 | 17 |
| DeploymentManager | 2026-05-16 | 9c60592 |
0/1/1/1 | 3 | 17 |
| ExternalSystemGateway | 2026-05-16 | 9c60592 |
0/1/1/1 | 3 | 17 |
| HealthMonitoring | 2026-05-16 | 9c60592 |
0/0/1/3 | 4 | 16 |
| Host | 2026-05-16 | 9c60592 |
0/0/1/3 | 4 | 15 |
| InboundAPI | 2026-05-16 | 9c60592 |
0/0/3/1 | 4 | 17 |
| ManagementService | 2026-05-16 | 9c60592 |
0/1/1/2 | 4 | 17 |
| NotificationService | 2026-05-16 | 9c60592 |
0/2/1/2 | 5 | 18 |
| Security | 2026-05-16 | 9c60592 |
0/0/2/2 | 4 | 15 |
| SiteEventLogging | 2026-05-16 | 9c60592 |
0/0/1/2 | 3 | 14 |
| SiteRuntime | 2026-05-16 | 9c60592 |
0/0/1/2 | 3 | 19 |
| StoreAndForward | 2026-05-16 | 9c60592 |
0/0/2/1 | 3 | 17 |
| TemplateEngine | 2026-05-16 | 9c60592 |
0/0/2/0 | 2 | 16 |
Pending Findings
Every Open / In Progress finding across all modules, highest severity first.
Resolved findings drop off this list but remain recorded in their module's
findings.md (see REVIEW-PROCESS.md §4–§5). Full detail —
description, location, recommendation — lives in the module's findings.md.
Critical (0)
None open.
High (8)
| ID | Module | Title |
|---|---|---|
| CentralUI-020 | CentralUI | Idle-session redirect never fires: SessionExpiry polls a frozen auth-state snapshot |
| Communication-012 | Communication | gRPC client factory ignores the endpoint on a cache hit, breaking NodeA→NodeB stream failover |
| DataConnectionLayer-014 | DataConnectionLayer | DCL-012 security warning is never logged in production: RealOpcUaClient is created without a logger |
| DeploymentManager-015 | DeploymentManager | Site-query reconciliation marks a deployment Success but skips instance-state and snapshot updates |
| ExternalSystemGateway-015 | ExternalSystemGateway | MaxRetries == 0 is buffered as "retry forever", contradicting the ExternalSystemGateway-004 "never retry" claim |
| ManagementService-014 | ManagementService | HandleQueryDeployments bypasses site-scope enforcement |
| NotificationService-014 | NotificationService | OAuth2 token-fetch failure escapes DeliverBufferedAsync; a permanently-broken config is retried forever |
| NotificationService-015 | NotificationService | Unclassified exceptions (OAuth2 token fetch, non-cancellation OCE) escape SendAsync to the calling script |
Medium (26)
| ID | Module | Title |
|---|---|---|
| CLI-014 | CLI | update commands require "core" fields, making partial updates impossible |
| CentralUI-021 | CentralUI | DebugView stream callback mutates Dictionary off the render thread |
| CentralUI-022 | CentralUI | Deployments push handler fires InvokeAsync with no disposal guard |
| ClusterInfrastructure-009 | ClusterInfrastructure | DownIfAlone is an inert configuration knob — never consumed by the HOCON builder |
| Communication-013 | Communication | Site gRPC address changes are never applied; RemoveSiteAsync has no production caller |
| ConfigurationDatabase-012 | ConfigurationDatabase | Inbound-API ApiKey.KeyValue bearer credential stored in plaintext |
| ConfigurationDatabase-013 | ConfigurationDatabase | Secret-column encryption silently falls back to an ephemeral (throwaway) key |
| DataConnectionLayer-015 | DataConnectionLayer | Initial-connect failures never trigger failover; an unreachable primary at startup never tries the backup |
| DataConnectionLayer-016 | DataConnectionLayer | HandleSubscribeCompleted reports SubscribeTagsResponse success even on a connection-level subscribe failure |
| DeploymentManager-016 | DeploymentManager | Reconciled prior record keeps its stale RevisionHash |
| ExternalSystemGateway-016 | ExternalSystemGateway | ConfigureHttpClientDefaults applies the ESG connection cap to every HttpClient in the host process |
| HealthMonitoring-015 | HealthMonitoring | Heartbeat-registered site is left with a year-0001 LastReportReceivedAt |
| Host-012 | Host | down-if-alone hard-coded in HOCON; ClusterOptions.DownIfAlone is never read |
| InboundAPI-014 | InboundAPI | ReturnDefinition is loaded but never used; script return value is unshaped/unvalidated |
| InboundAPI-015 | InboundAPI | ForbiddenApiChecker is purely textual and is bypassable via reflection reachable without a forbidden namespace token |
| InboundAPI-016 | InboundAPI | Routed Route.To().Call() invocations are not bound by the method timeout |
| ManagementService-015 | ManagementService | HandleSetInstanceOverrides applies overrides non-atomically |
| NotificationService-016 | NotificationService | AuthenticateAsync silently sends unauthenticated for an unknown auth type or empty credentials |
| Security-012 | Security | Partial LDAP failure during login yields a roleless authenticated session |
| Security-014 | Security | RefreshToken re-issues a token without checking the idle timeout |
| SiteEventLogging-012 | SiteEventLogging | Dropped events report success: Task is completed, not faulted, when the event cannot be persisted |
| SiteRuntime-017 | SiteRuntime | Instance Actor's live _attributes dictionary is shared by reference into child actor constructors |
| StoreAndForward-015 | StoreAndForward | EnqueueAsync's public contract never documents that maxRetries == 0 means "retry forever" |
| StoreAndForward-016 | StoreAndForward | Operator-initiated parked-message retry and discard are not replicated to the standby |
| TemplateEngine-015 | TemplateEngine | RenameCompositionAsync does not cascade-rename nested derived templates |
| TemplateEngine-016 | TemplateEngine | Composed-script ScriptScope.ParentPath is always empty, breaking Parent.X resolution for nested modules |
Low (32)
| ID | Module | Title |
|---|---|---|
| CLI-015 | CLI | Component-CLI.md command surface has drifted again in two places |
| CLI-016 | CLI | WriteAsTable derives columns from the first array element only |
| CentralUI-023 | CentralUI | Residual bare catch {} blocks swallow JS interop errors |
| CentralUI-024 | CentralUI | Claim lookups use magic strings instead of JwtTokenService constants |
| CentralUI-025 | CentralUI | SessionExpiry polling/redirect path has no test coverage |
| ClusterInfrastructure-010 | ClusterInfrastructure | Validator does not enforce DownIfAlone = true despite the design doc requiring it |
| Commons-013 | Commons | DynamicJsonElement.TryGetIndex rejects non-int index values |
| Commons-014 | Commons | OpcUaEndpointConfigSerializer.Deserialize can mislabel a corrupt typed row as Legacy |
| Communication-014 | Communication | Untrusted gRPC correlation_id flows directly into an Akka actor name |
| Communication-015 | Communication | No test exercises the real gRPC client factory across a node flip |
| ConfigurationDatabase-014 | ConfigurationDatabase | Redundant, inconsistent cast on one HasConversion call |
| DataConnectionLayer-017 | DataConnectionLayer | WriteBatchAsync aborts the whole batch on a mid-batch disconnect |
| DeploymentManager-017 | DeploymentManager | GetDeploymentStatusAsync XML doc describes behaviour it does not implement |
| ExternalSystemGateway-017 | ExternalSystemGateway | BuildUrl appends a bare trailing ? when a GET method's parameters are all null |
| HealthMonitoring-013 | HealthMonitoring | Offline-check interval comment claims "shorter timeout" but only ever uses OfflineTimeout |
| HealthMonitoring-014 | HealthMonitoring | HealthMonitoringOptions intervals are unvalidated; a zero/negative value crashes the hosted service |
| HealthMonitoring-016 | HealthMonitoring | SiteHealthCollector.CollectReport reads DateTimeOffset.UtcNow directly instead of an injected TimeProvider |
| Host-013 | Host | :F0 rounding of cluster timing values silently degrades sub-second configuration |
| Host-014 | Host | Serilog sinks are hard-coded in Program.cs, not configuration-driven (REQ-HOST-8) |
| Host-015 | Host | StartupRetry retries on every exception type, including permanent failures |
| InboundAPI-017 | InboundAPI | RouteHelper / RouteTarget has no test coverage |
| ManagementService-016 | ManagementService | Unexpected exception messages returned verbatim to HTTP callers |
| ManagementService-017 | ManagementService | QueryDeploymentsCommand has no test coverage |
| NotificationService-017 | NotificationService | NotificationOptions is bound from configuration but never read (dead config) |
| NotificationService-018 | NotificationService | Concurrency limiter: lock-free read of a non-volatile field, never resized on redeployment, never disposed |
| Security-013 | Security | ExtractFirstRdnValue mis-parses group DNs containing escaped commas |
| Security-015 | Security | Username is not trimmed before use in the LDAP filter, fallback DN, and JWT claims |
| SiteEventLogging-013 | SiteEventLogging | Keyword search does not escape SQL LIKE wildcards in user input |
| SiteEventLogging-014 | SiteEventLogging | Initial purge runs synchronously on the host startup thread |
| SiteRuntime-018 | SiteRuntime | ScriptExecutionActor XML doc still claims a "dedicated blocking I/O dispatcher" |
| SiteRuntime-019 | SiteRuntime | Dead DisableInstanceCommand / EnableInstanceCommand handlers in InstanceActor |
| StoreAndForward-017 | StoreAndForward | Retry/Discard activity-log entries hard-code the ExternalSystem category |