Executive summary
Read through the Production lens — the standard calibration. *Green* means good enough to run in production. The score is absolute and comparable across repos.
amirhosseinsaloot/dotnet-ddd carries serious risk (36%). Several issues below can materially affect reliability, security, or the cost of change and warrant near-term attention.
The area that most needs attention is Security (27%) — exposure to security and compliance incidents is elevated. Readiness (27%) is the next concern — operating, monitoring and recovering the system safely is harder.
Leadership focus, highest impact first: Encrypt sensitive data at rest (ASP.NET Core Data Protection /… (Data Protection); Protect endpoints by default-deny (Access Controls); CI workflow that builds and runs the test suite on every push/PR (CI/CD gates).
For scale: Hobby (~1,238 production lines); rebuilding it from scratch would take roughly ~0.1 person-years (~1 engineer). Approximate, ±~30%.
Code Health
74%
Adequate · gated by X4
Architecture
82%
Strong
Maturity
59%
Adequate · gated by M2
Readiness
27%
Weak · gated by D8, D9, P1, P3
Security
27%
Weak · gated by C1, C2
Domain Modelling
48%
Weak · gated by DM1, DM2, DM4
How the score is built — each lens's share of the headline
Width is the lens's weight in the worst-heaviest fold (the weakest area pulls hardest); colour is that lens's own band. A lens fixes the score in proportion to its width.
Security 27% · 46% weightReadiness 27% · 25% weightDomain Modelling 48% · 14% weightMaturity 59% · 8% weightCode Health 74% · 4% weightArchitecture 82% · 2% weight
Raise Security 27 → 70 (the Healthy floor) ⇒ headline 36 → ~43.
Code composition — where the lines go
Business logic 6%Plumbing 60%Generated 34%
Rebuild cost & value ~ Modeled — €410–€2,000
| Cost to rebuild | €410–€2,000 |
| Domain complexity | High |
| Quality factor | 0.7× (at 36% quality) |
| Size & shape | Hobby · 43% boilerplate · 48% straight-line · 9% branching logic |
This codebase represents roughly ~0.1 person-years of build effort (about ~€1,200 to rebuild). Its weakest lens is Security at 27% — the part of that asset most exposed by the findings below.
Top priorities
1
Resolve the 1 No automated tests finding(s) in Code Coverage.
2
Resolve the 1 No tests found finding(s) in Test Distribution.
3
Encrypt sensitive data at rest (ASP.NET Core Data Protection / column encryption) and manage keys in a vault. Skip if delegated to infra (Postgres TDE, KMS, etc.).
Diagnosis — what's actually going on
Highest-leverage move
Of everything flagged, the best return on effort is: Encrypt sensitive data at rest (ASP.NET Core Data Protection / column encryption) and manage keys in a vault. Skip if delegated to infra (Postgres TDE, KMS, etc.). The rest can wait behind it.
Architecture — module dependency graph
At a glance — Code Health
The Good
D1 · .NET / C#
Cyclomatic Complexity
10.0
D2 · .NET / C#
Cognitive Complexity
9.6
D3 · .NET / C#
God Classes
10.0
D4 · .NET / C#
Code Duplication
10.0
D17 · .NET / C#
Explicit Debt
9.8
D18 · .NET / C#
Solution Shape
10.0
D39 · .NET / C#
IL Efficiency
10.0
GD1 · Repo
Unfinished & placeholder code
10.0
IC1 · Repo
Incompleteness & stubs
10.0
X1 · Repo
Async correctness
10.0
X2 · Repo
Cancellation propagation
7.3
X3 · Repo
Exception handling
10.0
X5 · Repo
Nullable reference types
8.9
The Ugly
At a glance — Architecture
The Good
D5 · .NET / C#
Coupling
10.0
D6 · .NET / C#
Cohesion (LCOM4)
10.0
D26 · .NET / C#
Project Cohesion
10.0
D27 · .NET / C#
Navigability
9.9
D35 · .NET / C#
Change Coupling
10.0
AX1 · Repo
Captive dependencies
10.0
AX3 · Repo
Project dependency cycles
10.0
AX4 · Repo
Dependency direction
10.0
AX5 · Repo
Architecture & structure
10.0
AX6 · Repo
Interface segregation
10.0
The Ugly
At a glance — Maturity
The Good
The Ugly
At a glance — Readiness
The Good
The Bad
The Ugly
At a glance — Security
The Good
At a glance — Domain Modelling
The Good
The Ugly
Security & Compliance — OWASP Top-10 mapping
| OWASP category | Findings | Severity |
|---|---|---|
| A06:2021 — Vulnerable & Outdated Components | 1 | High / Critical |
Roadmap
First, encrypt sensitive data at rest and manage keys in a vault, or confirm if this is handled by infrastructure. Next, enforce default-deny access controls on all endpoints using authorization attributes or imperative guards. Then, establish a CI workflow to build and run tests on every push or pull request. Finally, address the single gaps in automated test coverage and test distribution to ensure comprehensive validation.
| Do this | Helps | Effort | Dimension |
|---|---|---|---|
| Resolve the 1 No automated tests finding(s) in Code Coverage. | +8.2 pts | Low | Code Coverage |
| Resolve the 1 No tests found finding(s) in Test Distribution. | +8.2 pts | Low | Test Distribution |
| Encrypt sensitive data at rest (ASP.NET Core Data Protection / column encryption) and manage keys in a vault. Skip if delegated to infra (Postgres TDE, KMS, etc.). | +8.8 pts | Medium | Data Protection |
| Protect endpoints by default-deny: [Authorize] + role/policy authorization, or imperative guard methods (throw-on-violation) called from every handler. | +8.8 pts | Medium | Access Controls |
| Add a CI workflow that builds and runs the test suite on every push/PR. | +8.8 pts | Medium | CI/CD gates |
| Extend structured logging to the remaining service-like projects so the whole executable surface is diagnosable in production. | +7.9 pts | Medium | Observability |
| Add security response headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) — defense in depth, even when a reverse proxy could set them. | +7.5 pts | Medium | Web-Security Posture |
| Resolve the 1 Deprecated finding(s) in Dependency Hygiene. | +2.2 pts | Low | Dependency Hygiene |
File quality
| File | Score | Band | Worst signal |
|---|---|---|---|
| src/DomainDrivenDesign.Domain/Interfaces/Specification/SpecificationBase.cs | 8.2 | Near-clean | Explicit Debt: CommentedOutCode |
| src/DomainDrivenDesign.Infrastructure/Extensions/ModelBuilderExtensions.cs | 8.5 | Near-clean | Cognitive Complexity: ModelBuilderExtensions.ApplyNamingConventions (cognitive 20) |
| src/DomainDrivenDesign.Api/Middlewares/GlobalExceptionHandlerMiddleware.cs | 9.5 | Near-clean | Comment Value: redundant comment |
Methodology & how to trust this report
Watchdog is a deep, periodic assessment — run each sprint, monthly, or quarterly, taking the time to go wider and deeper than a quick check and surfacing in one coherent report what you'd otherwise piece together from a dozen separate tools. It scores deterministically: the same commit yields the same score, every run. 52 of 55 evaluated dimensions are computed purely by tools and static analysis (confidence 1.0); 3 documentation/naming judgement(s) are LLM-assisted and labelled advisory. Overall confidence is 0.5 — the weighted average across measured dimensions; it falls as more of the score leans on LLM-assisted judgement and rises when it's fully tool-backed.
What we checked — 55 dimensions across the health lenses
D1D2D3D4D5D6D8D9D12D13D14D15D17D18D19D20D21D24D26D27D28D29D30D35D39AX1AX10AX3AX4AX5AX6C1C2DM1DM2DM4DM5DM6DM8GD1IC1M1M2M3M4P1P2P3P8S1X1X2X3X4X5
How to trust any code-health report — three questions
- Can you open the finding? Real findings cite a repo-relative file and line you can open at the cited line — never an absolute scratch path. Here, 6 of 24 do; the remainder are repo-wide signals — a dimension-level measurement, not a single line.
- Is there a tool behind the number? Every score below names the method that produced it — Roslyn, git, a scanner, or (for a handful of documentation/naming dimensions) an LLM labelled sampled · advisory — not a narrative.
- Does re-running give the same result? Run it again on the same commit and the score — and this report, byte for byte — is identical. A report whose numbers move between runs is describing the run, not the code.
Tools & methods
| Method | Backs | Version | Evaluator |
|---|---|---|---|
| Roslyn static analysis | Complexity, cohesion, coupling, dead code, API surface, layering | 5.3.0 | ✓ deterministic |
| Native secret scanner | Hardcoded secrets / credentials | 1.0.0 | ✓ deterministic |
| jscpd | Code duplication | — | ✓ deterministic |
| Coverage (coverlet / dotnet-coverage) | Line & branch coverage | 10.0.302 | ✓ deterministic |
| NuGet / dotnet | Outdated, vulnerable & deprecated dependencies | 10.0.302 | ✓ deterministic |
| git / LibGit2Sharp | Churn hotspots, knowledge concentration, history | 2.43.0 · 0.31.0 | ✓ deterministic |
| gitleaks · semgrep · trivy · checkov | Secrets in history, SAST, CVEs, IaC & container, PII / GDPR | 1.86.0 · 0.69.3 | ✓ deterministic |
| LLM (sampled · advisory) | Documentation quality, ADR conformance, naming — sampled over a bounded sample; advisory, never a deterministic measurement | Local LLM | ◐ LLM · sampled · advisory |
Run transparency — what happened this run
A clean run — every tool resolved and ran, and every applicable dimension was measured at full confidence. No scanner was unavailable, no analysis timed out or crashed, and nothing fell back to a degraded estimate.
Limitations & what we did not check
Watchdog assesses the repository exactly as committed, and only the repository. By design it does not reach outside the source tree: the live cloud account, the running CI/CD pipeline, the host's branch-protection and approval rules, the production configuration, or a restore actually exercised against a backup are all out of scope. That boundary is a feature, not a gap — a repo-relative, deterministic scan re-runs identically on any commit and every finding opens at a real file and line, where a live audit can neither be reproduced nor traced. The visible consequence is that controls which leave no in-repo evidence are reported as "not evidenced" and excluded from the score rather than awarded a number a static scan cannot justify.
Per-dimension blind spots
- D1 Cyclomatic Complexity: Cyclomatic complexity counts branches statically — it cannot tell an essential decision tree from accidental tangle, nor see complexity that lives in data or configuration (large switch-case token tables, DSL lexers/parsers, data-as-code rule tables) rather than control flow: a tokenizer's many single-character cases read as high complexity though each branch is trivial.
- D2 Cognitive Complexity: Cognitive-complexity heuristics approximate how hard code is to follow; genuine domain difficulty and well-named intent that eases reading are not captured.
- D3 God Classes: "God class" is sized by members and responsibilities visible in the type — a deliberately broad facade over a coherent subsystem can read the same as an accidental grab-bag. For front-end JS the file-length check is cohesion-aware (a single-responsibility module — one class/IIFE — earns a 3× threshold), but cohesion is approximated from top-level declarations, not true dependency structure.
- D4 Code Duplication: Duplication is token-similarity (jscpd) — it finds copy-paste, not semantic duplication expressed differently. Committed machine-written code (scaffolded migrations, designer/codegen output, protobuf/OpenAPI stubs, model snapshots) is EXCLUDED — its repetition is the tool's, not the team's — so the score reflects hand-written duplication only.
- D5 Coupling: Coupling is measured between projects/assemblies — runtime coupling through DI, reflection, messaging or shared databases is invisible to a static reference graph.
- D6 Cohesion (LCOM4): LCOM4 cohesion is syntactic — it infers connectivity from which methods touch which fields/methods by name, not from real runtime behaviour or intent.
- D8 Code Coverage: Coverage is measured by building and running the test suite inside Watchdog's isolated image — the target repo is never modified, and nothing on your systems runs. So coverage exists only when the suite builds and runs within the inline time budget; one that needs external services, can't build, or exceeds the budget yields no coverage (D8 then degrades to not-measured, not a low score). Line coverage also says nothing about assertion quality.
- D9 Test Distribution: The test-pyramid shape is inferred from project/folder naming and references, with a single test host bucketed per-file by its path tier and content signals — a suite that names tiers unconventionally and gives no per-file signal can still be mis-bucketed.
- D12 Dependency Hygiene: Dependency health reads manifests and lockfiles — a vulnerability in a vendored/copied dependency, or risk from how a dependency is actually used, is outside this view.
- D13 Secret Scanning: Secret detection is signature- and entropy-based on the current tree — a secret that does not match a known pattern, or one already rotated, will not be flagged (a clean scan is "nothing matched", not "no secrets exist").
- D14 License Compliance: License compatibility is checked against declared package metadata and a policy — mislabelled or missing license metadata, and obligations that depend on how you distribute, are not resolved here.
- D15 Churn × Complexity Hotspots: Churn hotspots come from git history — a freshly imported or squashed repository has no churn signal, and recent rewrites can mask a historically risky file.
- D17 Explicit Debt: Acknowledged-debt signals (TODO/FIXME, suppressions, dead code) are textual — undocumented debt that nobody marked, and debt that lives in design rather than annotations, is invisible. Committed machine-written code (scaffolded migrations, designer/codegen output, generated stubs) is excluded — it is never the team's dead code to delete.
- D18 Solution Shape: Build integrity reflects whether the solution compiled in this environment — a build that needs a private feed, a specific SDK, or a generated file absent from the repo can read as broken when it is merely unreproducible here.
- D19 Documentation Quality: Documentation quality is judged by an LLM over a bounded sample of docs — it reads what is written, not whether the docs match the running system, and it is advisory, not a measurement.
- D20 ADR Quality: ADR quality is an LLM read of the decision records present — it cannot know about decisions made and never recorded, and its verdict is sampled and advisory.
- D21 Naming Consistency: Naming quality is an LLM judgement over a bounded sample — it assesses clarity/consistency of the names it sees, not domain-correctness, and is advisory.
- D24 Comment Value: Comment value (WHY vs WHAT) is an LLM judgement over a bounded sample — it is advisory and cannot weigh a comment against the precise code change it was written to explain.
- D26 Project Cohesion: Project focus is sized from members/namespaces per project — a project that is broad by deliberate design reads the same as one that has sprawled.
- D27 Navigability: Indirection/navigability is structural — it measures hops to follow a call, not whether that indirection buys real flexibility or just ceremony.
- D28 Secrets (history): Secret-history scanning sweeps the git log for known patterns — a secret that predates the available history, or never matched a signature, is not found (clean means "nothing matched in the history we can see").
- D29 Static Analysis (SAST): SAST findings are pattern-based (semgrep) — it finds classes of bug it has rules for; logic flaws, auth/authorization gaps and issues needing runtime context are out of reach (and clean means "no rule matched").
- D30 Dependency Vulnerabilities: CVE matching depends on accurate package/version metadata and the advisory database — a vulnerability with no published advisory, or in code not declared as a dependency, is not seen.
- D35 Change Coupling: Change coupling is co-change in COMMITS — files split across separate commits, or coupled only through a shared config/build step, read as uncoupled, and a sweeping commit (rename/format) is excluded so it doesn't couple everything. It shows that files change together, not WHY: a high coupling can be a healthy cohesive pair as readily as a hidden leak.
- AX10 Code composition: Role is inferred from namespace/folder convention, not semantics — a domain concept living in a folder named "Services" reads as application, and the split is lines-of-code, not business value. The business-logic-share score is a SOFT, FLOORED signal: it contributes to the Architecture lens but is floored at the Critical gate, so an infrastructure-heavy design (a gateway, an ETL, a driver) is legitimately low without being nuked to zero.
- DM4 Rich vs anemic model: Behaviour is detected as state mutation inside a method body — a method that enforces an invariant by validating-and-throwing without mutating reads as a query, and mutation delegated through an interface the scan can't resolve isn't credited; entities with zero public properties still drop out of the population. It detects that state changes, not whether the rule is correct.
- DM6 Domain ↔ infrastructure boundary: Infrastructure reached through a hand-rolled wrapper, a domain-named facade, reflection, or a string-keyed service locator resolves to a non-infra type and isn't seen; the body scan is symbol resolution over syntax, not full dataflow. A clean result means "no resolved infra reference in a domain body", not a proof of purity.
- M4 Documentation accuracy: Onboarding quality is an LLM read of the docs/setup present — it cannot run the onboarding or measure how long a real new joiner takes; the verdict is sampled and advisory.
The LLM boundary
Dimensions
D1 · Cyclomatic Complexity
0 method(s) exceeded the cyclomatic complexity threshold of 15.
Do you agree with this assessment?
D2 · Cognitive Complexity
1 method(s) exceeded the cognitive complexity threshold of 15; the worst was ModelBuilderExtensions.ApplyNamingConventions at 20.
ModelBuilderExtensions.ApplyNamingConventions (cognitive 20)src/DomainDrivenDesign.Infrastructure/Extensions/ModelBuilderExtensions.cs:14
Do you agree with this assessment?
D3 · God Classes
0 god class(es) detected.
Do you agree with this assessment?
D4 · Code Duplication
0 duplicated block group(s) detected.
Do you agree with this assessment?
D5 · Coupling
3 projects, 0 dependency cycle(s), 0 unstable depended-on project(s).
Do you agree with this assessment?
D6 · Cohesion (LCOM4)
0 of 3 classes have LCOM4 above 3.
Do you agree with this assessment?
D8 · Code Coverage
No automated tests — no test code was found in this repository.
No automated tests
What to do
- Resolve the 1 No automated tests finding(s) in Code Coverage. — One of this dimension's main actionable groups (1 issue-level).
- Stand up a CI pipeline, then gate Code Coverage in it to reach Verified (currently Documented). — This repository has no CI pipeline, so there is nothing to add a gate to yet — the pipeline comes first. Hardens enforcement from Documented toward Verified — provenance only; does not change the score.
Do you agree with this assessment?
D9 · Test Distribution
No test suite found.
No tests found
What to do
- Resolve the 1 No tests found finding(s) in Test Distribution. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D12 · Dependency Hygiene
7 outdated, 0 vulnerable, 1 deprecated packages.
Deprecated: FluentValidation.AspNetCore
Outdated: Microsoft.EntityFrameworkCore.Tools
Do you agree with this assessment?
D13 · Secret Scanning
Secret scan ran and found no leaked secrets.
Do you agree with this assessment?
D14 · License Compliance
0 of 12 packages use a banned license.
Do you agree with this assessment?
D15 · Churn × Complexity Hotspots
No churn × complexity hotspots in the window.
git history depth insufficient
Do you agree with this assessment?
D17 · Explicit Debt
1 deducted debt markers + 0 dead symbols across 845 LoC (0.1/KLoC) → score 9.8.
CommentedOutCodesrc/DomainDrivenDesign.Domain/Interfaces/Specification/SpecificationBase.cs:13
Do you agree with this assessment?
D18 · Solution Shape
3 projects, 44 source files, 845 hand-written lines of code (845 production / 0 test), plus 638 generated (machine-written code — designer, scaffolded and tool-emitted files — excluded from quality), 3 inter-project edges.
Do you agree with this assessment?
D19 · Documentation Quality
The repository's README is a solid one-page overview that introduces the domain-driven design (DDD) approach and links to an Onion Architecture alternative. It begins with a strong rationale for the boilerplate role before listing the document outline: Introduction to DDD, Repository Structure, Domain Layer, Infrastructure Layer, Presentation Layer, Contributing, License — all present in the visible text. However, it is thin on content; only one paragraph of prose and no architecture or code walkthrough exists among the outlined sections, leaving the reader with a vague idea of what each layer does rather than concrete guidance.
XML-doc coverage: DomainDrivenDesign.Api src/DomainDrivenDesign.Api/DomainDrivenDesign.Api.csproj
What to do
- Improve Documentation Quality — currently 4.0/10. — The repository's README is a solid one-page overview that introduces the domain-driven design (DDD) approach and links to an Onion Architecture alternative. It begins with a strong rationale for the boilerplate role before listing the document outline: Introduction to DDD, Repository Structure, Domain Layer, Infrastructure Layer, Presentation Layer, Contributing, License — all present in the visible text. However, it is thin on content; only one paragraph of prose and no architecture or code walkthrough exists among the outlined sections, leaving the reader with a vague idea of what each layer does rather than concrete guidance.
Do you agree with this assessment?
D20 · ADR Quality
No architecture decision records were found.
No ADRs found
What to do
- Resolve the 1 No ADRs found finding(s) in ADR Quality. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D21 · Naming Consistency
0 naming inconsistencies across 200 sampled symbols.
Do you agree with this assessment?
D24 · Comment Value
12 valuable / 1 redundant across 29 sampled comments; 1 shown with locations.
redundant commentsrc/DomainDrivenDesign.Api/Middlewares/GlobalExceptionHandlerMiddleware.cs:25
What to do
- Resolve the 1 redundant comment finding(s) in Comment Value — start with GlobalExceptionHandlerMiddleware.cs. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D26 · Project Cohesion
0 of 3 projects flagged as possibly oversized/incoherent.
Do you agree with this assessment?
D27 · Navigability
99 % of calls cross a namespace and 2 % go through an interface, but 100 % of collaborators are co-located — so a call's collaborators sit together and tracing stays easy. Baseline: small — navigation cost is tolerated.
Do you agree with this assessment?
D28 · Secrets (history)
1 finding(s): 0 critical, 1 high, 0 medium, 0 low. Remediation for historically-committed secrets is credential rotation — they remain in history regardless of later deletion.
Do you agree with this assessment?
D29 · Static Analysis (SAST)
semgrep found no security issues.
Do you agree with this assessment?
D30 · Dependency Vulnerabilities
1 vulnerable package(s): 0 critical, 1 high, 0 medium, 0 low.
High CVE: Microsoft.OpenApi 2.4.1
Do you agree with this assessment?
D35 · Change Coupling
No strong hidden change-coupling between production files.
git history depth insufficient
Do you agree with this assessment?
D39 · IL Efficiency
0 of 66 first-party methods have an oversized IL body.
Do you agree with this assessment?
Frontend & cross-cutting dimensions
AX1 · Captive dependencies
Do you agree with this assessment?
AX10 · Code composition
Do you agree with this assessment?
AX3 · Project dependency cycles
Do you agree with this assessment?
AX4 · Dependency direction
Do you agree with this assessment?
AX5 · Architecture & structure
Do you agree with this assessment?
AX6 · Interface segregation
Do you agree with this assessment?
C1 · Data Protection
- No data-protection or encryption usage (ASP.NET Data Protection, AES, column encryption, PBKDF2) was found — sensitive data at rest may be unprotected. If TDE/KMS/vault is delegated to infrastructure, ignore.
What to do
- Encrypt sensitive data at rest (ASP.NET Core Data Protection / column encryption) and manage keys in a vault. Skip if delegated to infra (Postgres TDE, KMS, etc.).
- Enforce HTTPS (UseHttpsRedirection / RequireHttpsMetadata) so data in transit is always encrypted.
Do you agree with this assessment?
C2 · Access Controls
- No [Authorize]/policies and no imperative guard methods (throw-on-violation) were found — endpoints may be unprotected.
What to do
- Protect endpoints by default-deny: [Authorize] + role/policy authorization, or imperative guard methods (throw-on-violation) called from every handler.
Do you agree with this assessment?
DM1 · Aggregate boundaries
- `User` references the aggregate root `Team` directly (via `Team`) — hold its `TeamId` instead. — User.cs:41
What to do
- Reference other aggregates by their strongly-typed id, never by object reference, so each aggregate stays an independent consistency boundary.
Do you agree with this assessment?
DM2 · Strongly-typed ids
- `User.TeamId` is a raw `Int64` — give it a strongly-typed id: a dedicated single-field type wrapping the `Int64`, in whatever form your language spells that. — User.cs:39
- `Team.ParentTeamId` is a raw `Int64` — give it a strongly-typed id: a dedicated single-field type wrapping the `Int64`, in whatever form your language spells that. — Team.cs:16
What to do
- Adopt strongly-typed ids across the domain — finish the migration or document the boundary; primitive ids invite transposed-argument bugs.
Do you agree with this assessment?
DM4 · Rich vs anemic model
- `User` is an aggregate/entity with 12 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — User.cs:5
- `Team` is an aggregate/entity with 6 data propert(ies) but no state-changing behaviour (only data and queries) — the business logic lives in a service. — Team.cs:3
What to do
- Move business rules onto the aggregates/entities they govern so invariants are enforced at the source, not in anemic services.
Do you agree with this assessment?
DM5 · Encapsulated state
Do you agree with this assessment?
DM6 · Domain ↔ infrastructure boundary
Do you agree with this assessment?
DM8 · Value-object opportunities
Do you agree with this assessment?
GD1 · Unfinished & placeholder code
Do you agree with this assessment?
IC1 · Incompleteness & stubs
- A line of code has been commented out rather than removed — dead weight that rots and confuses. Delete it (version control remembers). — SpecificationBase.cs:17
What to do
- Clear the softer debt: remove commented-out code and dead branches, re-enable or delete skipped tests, and replace blanket warning suppressions with targeted ones.
Do you agree with this assessment?
M1 · Documentation (README)
What to do
- Add a build/run (quick start) section to the root README — the first thing a newcomer needs.
- Add a 'Testing' section to the root README — how to run the test suite.
- Add a README to the 3 of 3 project(s) that lack one — worth up to 2 pts.
Do you agree with this assessment?
M2 · Architecture documentation
- No Architecture Decision Records found — decisions aren't captured for future maintainers.
What to do
- Start an ADR log (docs/adr/) recording significant decisions and their rationale.
Do you agree with this assessment?
M3 · Folder & project structure
- Tests aren't grouped in a dedicated test folder — the test surface isn't separable from production code at a glance.
What to do
- Group tests in the folder your build system expects (tests/, test/, spec/, or your module's test source set) so the test surface is discoverable and CI can scope it.
Do you agree with this assessment?
M4 · Documentation accuracy
- Presentation layer merged with Application Layer
- README advertises a RAG / ML engine, but no ML/RAG code or dependency exists
What to do
- Reconcile the README with reality: Presentation layer merged with Application Layer; README advertises a RAG / ML engine, but no ML/RAG code or dependency exists.
Do you agree with this assessment?
P1 · CI/CD gates
- No CI workflow found (.github/workflows, azure-pipelines.yml, .gitlab-ci.yml, …) — changes aren't gated by an automated build/test.
What to do
- Add a CI workflow that builds and runs the test suite on every push/PR.
Do you agree with this assessment?
P2 · Observability
- Only 1/2 service-like projects use logging (pure contract/DTO projects are excluded — they have nothing to log).
What to do
- Extend structured logging to the remaining service-like projects so the whole executable surface is diagnosable in production.
- Consider OpenTelemetry tracing/metrics and a health-check endpoint for operability.
Do you agree with this assessment?
P3 · Security & performance tooling
- No static application security testing detected. For this repository's stack, add CodeQL's csharp pack (it analyses VB.NET too), or a security analyzer package (or `semgrep --config=auto`, which runs on any language) as a CI step.
What to do
- Add a SAST step to CI running what this repository's stack ships: CodeQL's csharp pack (it analyses VB.NET too), or a security analyzer package — or `semgrep --config=auto`, which runs on any language — so a security regression fails the build instead of landing.
- Enable Dependabot/Renovate or a dependency-review gate.
- Add gitleaks/trufflehog in CI to block PRs that introduce committed secrets.
Do you agree with this assessment?
P8 · Schema migrations
Do you agree with this assessment?
S1 · Web-Security Posture
- No Content-Security-Policy / X-Frame-Options / X-Content-Type-Options configuration found — defense in depth, even when a reverse proxy could set them. (−2.0 on this card.)
- No UseHttpsRedirection/UseHsts and no reverse-proxy signal — transport security is unverified at the app layer. (−2.0 on this card.)
What to do
- Add security response headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) — defense in depth, even when a reverse proxy could set them.
- Enforce HTTPS at the app layer (UseHttpsRedirection / UseHsts) — only skip this if a reverse proxy demonstrably terminates TLS.
Do you agree with this assessment?
X1 · Async correctness
Do you agree with this assessment?
X2 · Cancellation propagation
- Only 6/11 async methods accept a CancellationToken, so in-flight work can't be stopped early when the caller gives up — whatever ends it in your host (shutdown signal, timeout, abandoned request, user cancel). Thread a token through the call chain and honour it at each await and loop; where a method genuinely cannot be interrupted, omitting it is a deliberate choice — judge against your hosting model.
- No CancellationToken parameter — this work can't be stopped early once started. (×5) — GlobalExceptionHandlerMiddleware.cs:14, GlobalExceptionHandlerMiddleware.cs:36, RequestResponseLoggingMiddleware.cs:18, …
What to do
- Thread a CancellationToken through async methods so work stops promptly on cancellation.
Do you agree with this assessment?
X3 · Exception handling
Do you agree with this assessment?
X4 · Structured logging
- Logging an interpolated string (`$"..."`) collapses the event to plain text — you lose the named, queryable properties structured logging exists for. Use a message template with placeholders: `LogInformation("User {UserId} did {Action}", id, action)`. If these calls go through a logging wrapper that only accepts a pre-formatted string, give the wrapper a template+args overload that forwards to the underlying logger, then migrate call sites to it. — RequestResponseLoggingMiddleware.cs:30
What to do
- Interpolated log message defeats structured logging
Do you agree with this assessment?
X5 · Nullable reference types
- ~1.3 `!` suppressions per 1k syntax nodes — each one tells the compiler to trust you about null, suppressing the very safety NRTs provide.
What to do
- Enable <Nullable>enable</Nullable> across all projects and resolve warnings rather than suppressing with `!`.
Do you agree with this assessment?
Reference — by lens
| Lens | Score | Rating | Impact |
|---|---|---|---|
| Code Health | 74% | Adequate — gated by X4 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Architecture | 82% | Strong | Strongest area. |
| Maturity | 59% | Adequate — gated by M2 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Readiness | 27% | Weak — gated by D8, D9, P1, P3 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Security | 27% | Weak — gated by C1, C2 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Domain Modelling | 48% | Weak — gated by DM1, DM2, DM4 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
Not included — 48 check(s) not relevant to this codebase
- AC1 Text alternatives — No web markup found — accessibility is not applicable to this repository.
- AC2 Forms & labels — No web markup found — accessibility is not applicable to this repository.
- AC3 Page structure — No web markup found — accessibility is not applicable to this repository.
- AC4 Keyboard semantics — No web markup found — accessibility is not applicable to this repository.
- AC5 ARIA correctness — No web markup found — accessibility is not applicable to this repository.
- AC6 Visual & motion safety — No web markup found — accessibility is not applicable to this repository.
- AC7 A11y enforcement — No web markup found — accessibility is not applicable to this repository.
- AX2 Stateful singletons — no singleton implementations detected
- AX7 Slice cohesion — not applicable — not a vertical-slice architecture
- AX8 Test isolation — no test/production split to check
- AX9 CQS / query purity — no CQRS query handlers detected — query purity is not applicable to this codebase
- C3 Audit Trail — Repo shows no audit-logging mechanism (IAuditable, an immutable audit log, an EF SaveChanges interceptor) for sensitive changes — absence of evidence is not evidence of a working control. Record an audit trail in code (or document where it lives) so this dimension can be scored.
- C4 Data Retention — Repo shows no data-retention / TTL / cleanup mechanism for personal data — absence of evidence is not evidence of a working control. Define retention periods and a purge/cleanup job (or TTL) in code, or document where retention is enforced, so this dimension can be scored.
- C5 Data-Subject Rights — Repo shows no corroborated data-subject-rights mechanism (erasure / export-portability / consent) tied to a subject id or GDPR vocabulary — absence of evidence is not evidence of a working control. Implement erasure, data export/portability and consent tracking over the subject's records.
- D10 Test Quality — No tests were found in the analyzed repository to assess for quality.
- D11 Test Reliability — Test reliability not included
- D16 Bus Factor — single-maintainer — knowledge-concentration (bus factor) risk
- D22 Internal API Consistency — No exposed public API
- D23 Boundary Type-Coupling — At only 845 LoC the codebase is tiny and single-purpose despite three projects, so explicit boundaries are not needed.
- D25 ADR Conformance — no ADRs to check
- D31 IaC & Container Security — No Infrastructure-as-Code or container manifests found (Dockerfile, Terraform, Kubernetes/Helm, CloudFormation); nothing to scan.
- D32 Data Compliance (PII/GDPR) — No PII/GDPR ruleset is bundled (the public p/gdpr semgrep pack was retired) — data compliance is not assessed in this scan.
- D33 JS/npm Dependency Vulnerabilities — No JS/npm manifest or lockfile found outside build output (package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lockb); no JS dependencies to scan.
- D34 Knowledge Freshness — early-stage repository — too little history to judge knowledge freshness
- D36 Supply-chain Provenance & Signing — No CI/build pipeline found (.github/.forgejo/.gitea workflows, .gitlab-ci.yml, azure-pipelines.yml, Jenkinsfile, .circleci); there is no build to attest provenance for.
- D37 Vulnerability-disclosure Policy — No vulnerability-disclosure policy file found (SECURITY.md/.markdown/.rst/.txt at root or under .github/.forgejo/.gitea/docs, .well-known/security.txt). A coordinated-disclosure policy may live off-repo, so this is not evidenced rather than failed.
- D38 OSV Dependency Vulnerabilities — No supported non-.NET dependency lockfile found outside build output (npm package-lock/yarn/pnpm/bun, Go go.mod, Rust Cargo.lock, Maven pom.xml, Gradle lockfiles, Python requirements.txt/poetry.lock/Pipfile.lock/pdm.lock, PHP composer.lock, Ruby Gemfile.lock, Elixir mix.lock, Dart pubspec.lock, Swift Package.resolved); nothing for OSV to scan. A NuGet-only repo stays NotApplicable — .NET CVEs are D30's domain.
- D40 Network Egress Confinement — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here.
- D41 Kernel & Syscall Confinement — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here.
- D42 Runtime Threat Enforcement — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here.
- D7 Architectural Integrity — no checkable ADRs and no dependency cycles — architectural integrity not assessed
- DM3 Integration-event coupling — no integration events detected — coupling check not applicable
- DM7 Repository granularity — no repository abstraction detected (e.g. uses a document session)
- ED1 Event-Driven — not run — 0/3 markers found
- ED5 Idempotency — no mutating command handlers or message consumers detected — idempotency check not applicable
- ES1 Event Sourcing — not run — 0/3 markers found
- P12 CI test-gate honesty — no CI workflow found
- P4 Deployment & Rollback — not evidenced — no deploy/rollback/approval signal in the repo; absence of evidence is not evidence of a manual release
- P5 DR & Backup — not evidenced — repo shows no backup/RTO/RPO controls; absence of evidence is not evidence of a working control
- P6 Release Hygiene — not evidenced — no changelog, version stamp or semver release tag in the repo
- P7 Outbound HTTP resilience — no outbound HTTP usage detected
- P9 Domain vs controller coverage — no coverage report found on disk — produce a coverage report in a standard format (Cobertura — `dotnet test --collect:"XPlat Code Coverage"` with a `coverlet.collector` PackageReference) into the repo working tree before the scan — a CI step is the usual place, since the artefact is commonly gitignored, or wire coverage collection into CI, to enable this cross-layer check
- PF1 Benchmark discipline — Performance is assessed only for perf-relevant repos — a packaged library, one that ships benchmarks, or one already using allocation-aware APIs. This repo isn't one, so the Performance lens is not applicable and is excluded from the score.
- PF2 Allocation hygiene — Performance is assessed only for perf-relevant repos — a packaged library, one that ships benchmarks, or one already using allocation-aware APIs. This repo isn't one, so the Performance lens is not applicable and is excluded from the score.
- PF3 Async & latency hygiene — Performance is assessed only for perf-relevant repos — a packaged library, one that ships benchmarks, or one already using allocation-aware APIs. This repo isn't one, so the Performance lens is not applicable and is excluded from the score.
- SC1 Supply-chain hygiene — no data
- X6 Hand-rolled structured-format parsing — no data
- X7 Silent fallback defaults — no data
Appendix A — Findings (grouped)
Issue — 2 finding(s)
D30 · Dependency Vulnerabilities
- High CVE: Microsoft.OpenApi 2.4.1
D8 · Code Coverage
- No automated tests
Warning — 4 finding(s)
D12 · Dependency Hygiene
- Deprecated: FluentValidation.AspNetCore
D16 · Bus Factor
- single-maintainer — knowledge-concentration (bus factor) risk
D17 · Explicit Debt
- CommentedOutCode src/DomainDrivenDesign.Domain/Interfaces/Specification/SpecificationBase.cs:13
D2 · Cognitive Complexity
- ModelBuilderExtensions.ApplyNamingConventions (cognitive 20) src/DomainDrivenDesign.Infrastructure/Extensions/ModelBuilderExtensions.cs:14
Recommendation — 5 finding(s)
D11 · Test Reliability
- Test reliability not included
D20 · ADR Quality
- No ADRs found
D24 · Comment Value
- redundant comment src/DomainDrivenDesign.Api/Middlewares/GlobalExceptionHandlerMiddleware.cs:25
D34 · Knowledge Freshness
- early-stage repository — too little history to judge knowledge freshness
D9 · Test Distribution
- No tests found
Info — 13 finding(s)
D12 · Dependency Hygiene
- Outdated: Microsoft.EntityFrameworkCore.Tools
- Outdated: Swashbuckle.AspNetCore
- Outdated: Microsoft.EntityFrameworkCore
- Outdated: Microsoft.EntityFrameworkCore.Design
- Outdated: Microsoft.EntityFrameworkCore.Relational
- Outdated: Npgsql.EntityFrameworkCore.PostgreSQL
- Outdated: Microsoft.Extensions.Identity.Stores
D19 · Documentation Quality
- XML-doc coverage: DomainDrivenDesign.Api src/DomainDrivenDesign.Api/DomainDrivenDesign.Api.csproj
- XML-doc coverage: DomainDrivenDesign.Infrastructure src/DomainDrivenDesign.Infrastructure/DomainDrivenDesign.Infrastructure.csproj
- XML-doc coverage: DomainDrivenDesign.Domain src/DomainDrivenDesign.Domain/DomainDrivenDesign.Domain.csproj
D15 · Churn × Complexity Hotspots
- git history depth insufficient
D22 · Internal API Consistency
- No exposed public API
D35 · Change Coupling
- git history depth insufficient
Appendix B — Reproduction & audit trail
| Dimension | Tool | Version | Command | Findings | Raw output |
|---|---|---|---|---|---|
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-banner --report-format json --report-path /dev/stdout --exit-code 0 --source . | 1 | artifacts/raw/gitleaks-history.json |
| D29 · Static Analysis (SAST) | semgrep | — | semgrep --config /opt/semgrep-rules/security-audit.yml --config /opt/semgrep-rules/owasp-top-ten.yml --json --quiet --timeout 0 --metrics off . | 0 | artifacts/raw/semgrep.json |
| D30 · Dependency Vulnerabilities | dotnet | — | dotnet list DomainDrivenDesign.sln package --vulnerable --include-transitive --format json | 1 | artifacts/raw/dotnet-vulnerable.json |
| D31 · IaC & Container Security | trivy | — | trivy: not applicable — No Infrastructure-as-Code or container manifests found (Dockerfile, Terraform, Kubernetes/Helm, CloudFormation); nothing to scan. | 0 | — |
| D32 · Data Compliance (PII/GDPR) | semgrep | — | semgrep: not applicable — No PII/GDPR ruleset is bundled (the public p/gdpr semgrep pack was retired) — data compliance is not assessed in this scan. | 0 | — |
| D33 · JS/npm Dependency Vulnerabilities | trivy | — | trivy: not applicable — No JS/npm manifest or lockfile found outside build output (package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lockb); no JS dependencies to scan. | 0 | — |
| D36 · Supply-chain Provenance & Signing | provenance | — | provenance: not applicable — No CI/build pipeline found (.github/.forgejo/.gitea workflows, .gitlab-ci.yml, azure-pipelines.yml, Jenkinsfile, .circleci); there is no build to attest provenance for. | 0 | — |
| D37 · Vulnerability-disclosure Policy | disclosure | — | disclosure: not applicable — No vulnerability-disclosure policy file found (SECURITY.md/.markdown/.rst/.txt at root or under .github/.forgejo/.gitea/docs, .well-known/security.txt). A coordinated-disclosure policy may live off-repo, so this is not evidenced rather than failed. | 0 | — |
| D38 · OSV Dependency Vulnerabilities | osv-scanner | — | osv-scanner: not applicable — No supported non-.NET dependency lockfile found outside build output (npm package-lock/yarn/pnpm/bun, Go go.mod, Rust Cargo.lock, Maven pom.xml, Gradle lockfiles, Python requirements.txt/poetry.lock/Pipfile.lock/pdm.lock, PHP composer.lock, Ruby Gemfile.lock, Elixir mix.lock, Dart pubspec.lock, Swift Package.resolved); nothing for OSV to scan. A NuGet-only repo stays NotApplicable — .NET CVEs are D30's domain. | 0 | — |
| D40 · Network Egress Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; network egress policy is a cluster-native control that may live at the platform/firewall layer, so there is nothing to assess here. | 0 | — |
| D41 · Kernel & Syscall Confinement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; seccomp/AppArmor/SELinux confinement is a workload-level control, so there is nothing to assess here. | 0 | — |
| D42 · Runtime Threat Enforcement | runtime-hardening | — | runtime-hardening: not applicable — No Kubernetes/orchestration workloads found in the repository manifests; runtime threat-detection and admission-control policy are cluster-level controls, so there is nothing to assess here. | 0 | — |
Appendix C — Personal-data map
Name — 2 field(s)
- User.Firstname src/DomainDrivenDesign.Domain/Entities/IdentityAggregate/User.cs:23
- User.Lastname src/DomainDrivenDesign.Domain/Entities/IdentityAggregate/User.cs:25
Date of birth — 1 field(s)
- User.Birthdate src/DomainDrivenDesign.Domain/Entities/IdentityAggregate/User.cs:27