Executive summary
Read through the Production lens — the standard calibration. *Green* means good enough to run in production. The score is absolute and comparable across repos.
bitwarden/server carries serious risk (54%). Several issues below can materially affect reliability, security, or the cost of change and warrant near-term attention.
It is strongest in Event-Driven (100%) — its messaging keeps components properly decoupled. Architecture (83%) is solid too.
The area that most needs attention is Readiness (42%) — operating, monitoring and recovering the system safely is harder. Code Health (61%) is the next concern — changes there are slower and more error-prone.
Leadership focus, highest impact first: 1 No ADRs found finding(s) in ADR Quality (ADR Quality); Name events in the past tense (Event naming); Raise allocation-aware density on the hot paths (Allocation hygiene).
For scale: Large (~205,017 production lines); rebuilding it from scratch would take roughly ~7.5 person-years (~4–15 engineers). Approximate, ±~30%.
It builds on a genuinely strong Event-Driven foundation (100%); the priorities above are the highest-leverage way to bring the rest up to that level.
Code Health
61%
Fair · gated by IC1
Architecture
83%
Healthy
Maturity
72%
Healthy
Readiness
42%
Poor · gated by D12, P7, P9
Security
63%
Fair · gated by D31, D33, D36, D38
Event-Driven
100% ★
Exemplary
Accessibility
65%
Fair
Performance
67%
Fair
Code composition — where the lines go
Business logic 5%Plumbing 11%Tests 18%Generated 66%
Rebuild cost & value ~ Modeled — €360,000–€1,800,000
| Cost to rebuild | €360,000–€1,800,000 |
| Domain complexity | Very high |
| Quality factor | 0.8× (at 54% quality) |
| Size & shape | Large · 37% boilerplate · 30% straight-line · 32% branching logic |
This codebase represents roughly ~7.5 person-years of build effort (about ~€1,100,000 to rebuild). Its weakest lens is Readiness at 42% — the part of that asset most exposed by the findings below.
Top priorities
1
Resolve the 1 No ADRs found finding(s) in ADR Quality.
2
Name events in the past tense — they record facts that already happened.
3
Raise allocation-aware density on the hot paths — currently 12 use(s) across 1,022,061 production line(s) (~0.0/1k). More Span/Memory, pooling (ArrayPool/ObjectPool), stackalloc and ValueTask on the allocation-heavy paths climbs this toward 10.
Diagnosis — what's actually going on
Value concentrated against a weak lens
This is a Large asset (~7.5 person-years to rebuild), and its weakest lens is Readiness at 42%. The operational and business risk on an asset this size concentrates there — that's where remediation buys the most protection.
Highest-leverage move
Of everything flagged, the best return on effort is: Resolve the 1 No ADRs found finding(s) in ADR Quality. The rest can wait behind it.
Coverage is high but aimed at the wrong layer
Overall coverage looks healthy (D8 9.6/10) yet it's concentrated on controllers/endpoints, not the domain — the headline coverage number is reassuring but misleading about where the real risk sits.
Architecture — bounded-context dependency graph
At a glance — Code Health
The Good
D3 · .NET / C#
God Classes
9.1
D4 · .NET / C#
Code Duplication
9.8
D17 · .NET / C#
Explicit Debt
7.8
D18 · .NET / C#
Solution Shape
10.0
GD1 · Repo
Unfinished & placeholder code
10.0
X1 · Repo
Async correctness
7.9
X3 · Repo
Exception handling
7.8
X4 · Repo
Structured logging
10.0
X5 · Repo
Nullable reference types
9.9
At a glance — Architecture
The Good
D5 · .NET / C#
Coupling
10.0
D6 · .NET / C#
Cohesion (LCOM4)
9.2
D22 · .NET / C#
Internal API Consistency
10.0
AX1 · Repo
Captive dependencies
7.7
AX3 · Repo
Project dependency cycles
10.0
AX4 · Repo
Dependency direction
10.0
AX5 · Repo
Architecture & structure
10.0
AX6 · Repo
Interface segregation
9.8
AX8 · Repo
Test isolation
10.0
AX9 · Repo
CQS / query purity
10.0
The Ugly
At a glance — Maturity
The Ugly
At a glance — Readiness
The Good
D8 · .NET / C#
Code Coverage
9.6
D9 · .NET / C#
Test Distribution
10.0
D10 · .NET / C#
Test Quality
9.8
D11 · .NET / C#
Test Reliability
10.0
D13 · .NET / C#
Secret Scanning
10.0
P1 · Repo
CI/CD gates
10.0
P2 · Repo
Observability
9.2
P4 · Repo
Deployment & Rollback
7.0
P5 · Repo
DR & Backup
7.0
P8 · Repo
Schema migrations
10.0
The Ugly
At a glance — Security
The Good
The Bad
The Ugly
At a glance — Event-Driven
At a glance — Accessibility
The Good
The Bad
The Ugly
At a glance — Performance
The Good
Security & Compliance — OWASP Top-10 mapping
| OWASP category | Findings | Severity |
|---|---|---|
| A06:2021 — Vulnerable & Outdated Components | 59 | High / Critical |
| A05:2021 — Security Misconfiguration | 20 | High / Critical |
| A02:2021 — Cryptographic Failures | 4 | High / Critical |
Roadmap
Top priorities: Resolve the 1 No ADRs found finding(s) in ADR Quality; Name events in the past tense — they record facts that already happened; Raise allocation-aware density on the hot paths — currently 12 use(s) across 1,022,061 production line(s) (~0.0/1k). More Span/Memory, pooling (ArrayPool/ObjectPool), stackalloc and ValueTask on the allocation-heavy paths climbs this toward 10.
| Do this | Helps | Effort | Dimension |
|---|---|---|---|
| Resolve the 1 No ADRs found finding(s) in ADR Quality. | +3.1 pts | Low | ADR Quality |
| Name events in the past tense — they record facts that already happened. | +1.9 pts | Medium | Event naming |
| Raise allocation-aware density on the hot paths — currently 12 use(s) across 1,022,061 production line(s) (~0.0/1k). More Span/Memory, pooling (ArrayPool/ObjectPool), stackalloc and ValueTask on the allocation-heavy paths climbs this toward 10. | +1.7 pts | Medium | Allocation hygiene |
| Make the call chain async end-to-end and await it — never block on a Task with .Wait()/.GetAwaiter().GetResult() in library code. | +1.7 pts | Medium | Async & latency hygiene |
| Start an ADR log (docs/adr/) recording significant decisions and their rationale. | +1.6 pts | Medium | Architecture documentation |
| Enforce accessibility in the toolchain: add eslint-plugin-jsx-a11y (or vuejs-accessibility), assert with jest-axe / playwright-axe in tests, then gate axe/pa11y/Lighthouse in CI. | +1.5 pts | Medium | A11y enforcement |
| Add a build/run (quick start) section to the root README — the first thing a newcomer needs. | +1.1 pts | Medium | Documentation (README) |
| Declare <html lang>, a document <title> and a <main> landmark, keep headings in order, leave zoom enabled, title iframes and drop meta-refresh. | +1.1 pts | Medium | Page structure |
File quality
| File | Score | Band | Worst signal |
|---|---|---|---|
| src/Core/MailTemplates/Mjml/package-lock.json | 0.2 | Slop | JS/npm Dependency Vulnerabilities: High CVE: [CVE redacted] |
| src/Admin/package-lock.json | 0.6 | Slop | OSV Dependency Vulnerabilities: High CVE: [GHSA redacted] |
| bitwarden_license/src/Sso/package-lock.json | 1.4 | Slop | OSV Dependency Vulnerabilities: High CVE: [GHSA redacted] |
| src/Core/Settings/GlobalSettings.cs | 3.9 | Slop | Secrets (history): Secret: jwt |
| src/Core/Core.csproj | 4.1 | Mixed | Explicit Debt: NoWarnInCsproj |
| src/Api/Api.csproj | 4.2 | Mixed | Explicit Debt: NoWarnInCsproj |
| util/SeederApi/Dockerfile | 5.1 | Mixed | IaC & Container Security: High IaC: DS-0002 |
| test/Api.Test/Auth/Controllers/AccountsControllerTests.cs | 5.3 | Mixed | Test Quality: No assertions: PostKdf_ChangeKdfSuccess_NoError |
| util/Setup/Setup.csproj | 5.5 | Mixed | Explicit Debt: NoWarnInCsproj |
| src/Api/Utilities/ApiHelpers.cs | 5.8 | Mixed | Explicit Debt: EmptyCatchBlock |
| util/RustSdk/rust/Cargo.lock | 5.8 | Mixed | OSV Dependency Vulnerabilities: Medium CVE: RUSTSEC-2026-0097 |
| src/Infrastructure.Dapper/Tools/Repositories/SendRepository.cs | 5.9 | Mixed | Code Duplication: Duplicated block (16 lines × 2) |
| src/Events/Controllers/CollectController.cs | 6.0 | Mixed | Explicit Debt: FixmeComment |
| src/Core/Billing/Organizations/Models/OrganizationLicense.cs | 6.0 | Mixed | Explicit Debt: FixmeComment |
| src/Core/OrganizationFeatures/OrganizationSubscriptions/UpgradeOrganizationPlanCommand.cs | 6.0 | Mixed | Explicit Debt: FixmeComment |
| src/Core/Auth/Models/Api/Request/Accounts/RegisterFinishRequestModel.cs | 6.0 | Mixed | Explicit Debt: TodoComment |
| src/Admin/AdminConsole/Controllers/OrganizationsController.cs | 6.0 | Mixed | Explicit Debt: FixmeComment |
| src/Core/Platform/Mail/HandlebarsMailService.cs | 6.0 | Mixed | Explicit Debt: TodoComment |
| src/Core/AdminConsole/Models/Data/Organizations/SelfHostedOrganizationDetails.cs | 6.0 | Mixed | Explicit Debt: FixmeComment |
| src/Billing/Controllers/PayPalController.cs | 6.0 | Mixed | Explicit Debt: FixmeComment |
Methodology & how to trust this report
Watchdog is a deep, periodic assessment — run each sprint, monthly, or quarterly, taking the time to go wider and deeper than a quick check and surfacing in one coherent report what you'd otherwise piece together from a dozen separate tools. It scores deterministically: the same commit yields the same score, every run. 69 of 69 evaluated dimensions are computed purely by tools and static analysis (confidence 1.0); none rely on LLM judgement. Overall confidence is 0.8 — the weighted average across measured dimensions; it falls as more of the score leans on LLM-assisted judgement and rises when it's fully tool-backed.
What we checked — 69 dimensions across the health lenses
D1D2D3D4D5D6D8D9D10D11D12D13D15D17D18D20D22D27D28D29D30D31D33D36D37D38AC2AC3AC5AC6AC7AX1AX10AX2AX3AX4AX5AX6AX8AX9C1C2C4C5ED3ED4GD1IC1M1M2M3P1P2P3P4P5P6P7P8P9PF1PF2PF3S1X1X2X3X4X5
How to trust any code-health report — three questions
- Can you open the finding? Real findings cite a repo-relative file and line you can open at the cited line — never an absolute scratch path. Here, 1772 of 2119 do; the remainder are repo-wide signals — a dimension-level measurement, not a single line.
- Is there a tool behind the number? Every score below names the method that produced it — Roslyn, git, a scanner, or (for a handful of documentation/naming dimensions) an LLM labelled sampled · advisory — not a narrative.
- Does re-running give the same result? Run it again on the same commit and the score — and this report, byte for byte — is identical. A report whose numbers move between runs is describing the run, not the code.
Tools & methods
| Method | Backs | Version | Evaluator |
|---|---|---|---|
| Roslyn static analysis | Complexity, cohesion, coupling, dead code, API surface, layering | 5.3.0 | ✓ deterministic |
| Native secret scanner | Hardcoded secrets / credentials | 1.0.0 | ✓ deterministic |
| jscpd | Code duplication | — | ✓ deterministic |
| Coverage (coverlet / dotnet-coverage) | Line & branch coverage | 10.0.300 | ✓ deterministic |
| NuGet / dotnet | Outdated, vulnerable & deprecated dependencies | 10.0.300 | ✓ deterministic |
| git / LibGit2Sharp | Churn hotspots, knowledge concentration, history | 2.43.0 · 0.31.0 | ✓ deterministic |
| gitleaks · semgrep · trivy · checkov | Secrets in history, SAST, CVEs, IaC & container, PII / GDPR | 1.86.0 · 0.69.3 | ✓ deterministic |
| LLM (sampled · advisory) | Documentation quality, ADR conformance, naming — sampled over a bounded sample; advisory, never a deterministic measurement | openai-compatible | ◐ LLM · sampled · advisory |
Run transparency — what happened this run
- D19 Documentation Quality — LLM provider failed — The model provider was unreachable or errored, so this LLM-assisted dimension fell back to a measurement gap (confidence 0) rather than a penalty. Re-run with a reachable provider to score it.
- D21 Naming Consistency — LLM provider failed — The model provider was unreachable or errored, so this LLM-assisted dimension fell back to a measurement gap (confidence 0) rather than a penalty. Re-run with a reachable provider to score it.
- D23 Boundary Type-Coupling — evaluation did not complete — Dimension evaluation failed — excluded from the score.
- D24 Comment Value — LLM provider failed — The model provider was unreachable or errored, so this LLM-assisted dimension fell back to a measurement gap (confidence 0) rather than a penalty. Re-run with a reachable provider to score it.
- D26 Project Cohesion — evaluation did not complete — Dimension evaluation failed — excluded from the score.
- D32 Data Compliance (PII/GDPR) — scanner not present in this environment — The backing tool was not installed where this scan ran, so this dimension was not scored. Install the tool (or run in the hosted environment, where it is always present) for a graded result.
Limitations & what we did not check
Watchdog assesses the repository exactly as committed, and only the repository. By design it does not reach outside the source tree: the live cloud account, the running CI/CD pipeline, the host's branch-protection and approval rules, the production configuration, or a restore actually exercised against a backup are all out of scope. That boundary is a feature, not a gap — a repo-relative, deterministic scan re-runs identically on any commit and every finding opens at a real file and line, where a live audit can neither be reproduced nor traced. The visible consequence is that controls which leave no in-repo evidence are reported as "not evidenced" and excluded from the score rather than awarded a number a static scan cannot justify.
Per-dimension blind spots
- D1 Cyclomatic Complexity: Cyclomatic complexity counts branches statically — it cannot tell an essential decision tree from accidental tangle, nor see complexity that lives in data or configuration (large switch-case token tables, DSL lexers/parsers, data-as-code rule tables) rather than control flow: a tokenizer's many single-character cases read as high complexity though each branch is trivial.
- D2 Cognitive Complexity: Cognitive-complexity heuristics approximate how hard code is to follow; genuine domain difficulty and well-named intent that eases reading are not captured.
- D3 God Classes: "God class" is sized by members and responsibilities visible in the type — a deliberately broad facade over a coherent subsystem can read the same as an accidental grab-bag. For front-end JS the file-length check is cohesion-aware (a single-responsibility module — one class/IIFE — earns a 3× threshold), but cohesion is approximated from top-level declarations, not true dependency structure.
- D4 Code Duplication: Duplication is token-similarity (jscpd) — it finds copy-paste, not semantic duplication expressed differently. Committed machine-written code (EF migration scaffolds, *.Designer.cs, model snapshots) is EXCLUDED — its repetition is the tool's, not the team's — so the score reflects hand-written duplication only; the generated footprint is reported separately under Solution Shape.
- D5 Coupling: Coupling is measured between projects/assemblies — runtime coupling through DI, reflection, messaging or shared databases is invisible to a static reference graph.
- D6 Cohesion (LCOM4): LCOM4 cohesion is syntactic — it infers connectivity from which methods touch which fields/methods by name, not from real runtime behaviour or intent.
- D8 Code Coverage: Coverage is measured by building and running the suite (`dotnet test --collect`) inside Watchdog's isolated image — the target repo is never modified, and nothing on your systems runs. So coverage exists only when the suite builds and runs within the inline time budget; one that needs external services, can't build, or exceeds the budget yields no coverage (D8 then degrades to not-measured, not a low score). Line coverage also says nothing about assertion quality.
- D9 Test Distribution: The test-pyramid shape is inferred from project/folder naming and references, with a single test host bucketed per-file by its path tier and content signals — a suite that names tiers unconventionally and gives no per-file signal can still be mis-bucketed.
- D10 Test Quality: Assertion density is structural — it cannot tell a meaningful behavioural assertion from a trivial one, only that an assertion is present.
- D11 Test Reliability: Flakiness is inferred from history/markers — Watchdog runs the suite once (for coverage), not the repeated runs under varied conditions that reveal nondeterminism, so a flaky test never recorded as failing is invisible here.
- D12 Dependency Hygiene: Dependency health reads manifests and lockfiles — a vulnerability in a vendored/copied dependency, or risk from how a dependency is actually used, is outside this view.
- D13 Secret Scanning: Secret detection is signature- and entropy-based on the current tree — a secret that does not match a known pattern, or one already rotated, will not be flagged (a clean scan is "nothing matched", not "no secrets exist").
- D15 Churn × Complexity Hotspots: Churn hotspots come from git history — a freshly imported or squashed repository has no churn signal, and recent rewrites can mask a historically risky file.
- D17 Explicit Debt: Acknowledged-debt signals (TODO/FIXME, suppressions, dead code) are textual — undocumented debt that nobody marked, and debt that lives in design rather than annotations, is invisible. Committed machine-written code (EF migrations, designer files, snapshots) is excluded — it is never the team's dead code to delete.
- D18 Solution Shape: Build integrity reflects whether the solution compiled in this environment — a build that needs a private feed, a specific SDK, or a generated file absent from the repo can read as broken when it is merely unreproducible here.
- D20 ADR Quality: ADR quality is an LLM read of the decision records present — it cannot know about decisions made and never recorded, and its verdict is sampled and advisory.
- D22 Internal API Consistency: API-surface coherence is an LLM judgement over a sample of the public surface — consistency of intent across the whole API is approximated, not exhaustively verified.
- D27 Navigability: Indirection/navigability is structural — it measures hops to follow a call, not whether that indirection buys real flexibility or just ceremony.
- D28 Secrets (history): Secret-history scanning sweeps the git log for known patterns — a secret that predates the available history, or never matched a signature, is not found (clean means "nothing matched in the history we can see").
- D29 Static Analysis (SAST): SAST findings are pattern-based (semgrep) — it finds classes of bug it has rules for; logic flaws, auth/authorization gaps and issues needing runtime context are out of reach (and clean means "no rule matched").
- D30 Dependency Vulnerabilities: CVE matching depends on accurate package/version metadata and the advisory database — a vulnerability with no published advisory, or in code not declared as a dependency, is not seen.
- D31 IaC & Container Security: IaC scanning checks Dockerfiles/Terraform/Kubernetes against best-practice rules — it cannot see the live cloud account, runtime configuration, or drift between the committed config and what is actually deployed.
- D33 JS/npm Dependency Vulnerabilities: JS/npm CVE matching reads package manifests and lockfiles — risk from how a dependency is used, and advisories not yet published, fall outside this scan.
- AC2 Forms & labels: Label association is read from static markup — a label wired up at runtime (JS-set aria-labelledby, framework-injected ids) reads as missing, a present label says nothing about whether its text is correct, and component-wrapped fields (e.g. a <TextField>) are skipped. A clean result is "no unlabelled native control found", not a labelling proof.
- AC3 Page structure: Page structure is read from the static markup tree — landmarks, headings and lang injected at runtime aren't seen, heading ORDER is checked structurally (not against the rendered visual hierarchy), and lang/title/main fire only on full documents, never partials. Static readiness, not conformance.
- AC5 ARIA correctness: ARIA correctness is checked against the static role/attribute shape — roles/attributes set dynamically aren't seen, a valid role says nothing about whether it matches the element's real behaviour, and required-state checks are suppressed when a JSX spread could supply them.
- AC6 Visual & motion safety: Contrast and motion safety are PARTIAL by construction — only literal inline colours and in-repo <style>-block CSS are read; external stylesheets, CSS-in-JS, computed/runtime/theme colour, and image contrast are all out of reach, so a clean result is bounded by what the markup itself shows.
- AC7 A11y enforcement: Enforcement is scored from in-repo config/CI evidence only — an a11y gate enforced in external tooling with no in-repo trace can't be credited, and a configured linter is presence, not proof the rules actually run or block a merge.
- AX10 Code composition: Role is inferred from namespace/folder convention, not semantics — a domain concept living in a folder named "Services" reads as application, and the split is lines-of-code, not business value. The business-logic-share score is ADVISORY: an infrastructure-heavy design (a gateway, an ETL, a driver) is legitimately low without being unhealthy.
- AX9 CQS / query purity: Handlers are found by interface/name convention — a query handler using neither is not seen. Mutation is a resolved write/publish invocation (SaveChanges/repository/bus), so a write hidden behind a hand-rolled wrapper, reflection, or a string-keyed service locator resolves to a non-persistence type and isn't flagged; it detects that a query writes state, not whether the write is a legitimate read-side cache update. Clean means "no resolved write/publish in a query body", not a proof of CQS purity.
- C4 Data Retention: This control is scored from in-repo evidence only — its real-world effectiveness, exercised only at runtime, is outside a static scan.
- C5 Data-Subject Rights: This control is scored from in-repo evidence only — absence of evidence here means the scan found no in-repo trace, not that the control does not exist.
- P4 Deployment & Rollback: Approval/branch-protection rules live in repository settings the scan cannot see — only their in-repo evidence (config files, workflows) is checked, so a control enforced purely in the host's settings reads as "not evidenced".
- P5 DR & Backup: Backup/restore and disaster-recovery readiness is judged from in-repo evidence — a config that exists is not a tested restore, so the absence of positive evidence is reported as "not evidenced", never scored as present.
- P6 Release Hygiene: Rollback/observability controls are inferred from repo artefacts (pipelines, dashboards-as-code) — controls configured in external tooling, with no in-repo trace, cannot be credited.
The LLM boundary
Dimensions
D1 · Cyclomatic Complexity
67 method(s) exceeded the cyclomatic complexity threshold of 15; the worst was CollectController.Post at 55.
CollectController.Post (cyclomatic 55)src/Events/Controllers/CollectController.cs:41
OrganizationLicense.GetDataBytes (cyclomatic 54)src/Core/Billing/Organizations/Models/OrganizationLicense.cs:182
HubHelpers.SendNotificationToHubAsync (cyclomatic 50)src/Notifications/HubHelpers.cs:28
UpgradeOrganizationPlanCommand.UpgradePlanAsync (cyclomatic 49)src/Core/OrganizationFeatures/OrganizationSubscriptions/UpgradeOrganizationPlanCommand.cs:85
OrganizationLicense.ObsoleteVerifyData (cyclomatic 42)src/Core/Billing/Organizations/Models/OrganizationLicense.cs:503
What to do
- Resolve the 1 CollectController.Post (cyclomatic 55) finding(s) in Cyclomatic Complexity — start with CollectController.cs. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 OrganizationLicense.GetDataBytes (cyclomatic 54) finding(s) in Cyclomatic Complexity — start with OrganizationLicense.cs. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 HubHelpers.SendNotificationToHubAsync (cyclomatic 50) finding(s) in Cyclomatic Complexity — start with HubHelpers.cs. — One of this dimension's main actionable groups (1 warning-level).
- Enforce Cyclomatic Complexity in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D2 · Cognitive Complexity
97 method(s) exceeded the cognitive complexity threshold of 15; the worst was UpgradeOrganizationPlanCommand.UpgradePlanAsync at 63.
UpgradeOrganizationPlanCommand.UpgradePlanAsync (cognitive 63)src/Core/OrganizationFeatures/OrganizationSubscriptions/UpgradeOrganizationPlanCommand.cs:85
Context.LoadConfiguration (cognitive 61)util/Setup/Context.cs:67
CoreHelpers.BuildIdentityClaims (cognitive 57)src/Core/Utilities/CoreHelpers.cs:716
CollectController.Post (cognitive 54)src/Events/Controllers/CollectController.cs:41
RegisterFinishRequestModel.Validate (cognitive 46)src/Core/Auth/Models/Api/Request/Accounts/RegisterFinishRequestModel.cs:167
What to do
- Resolve the 1 UpgradeOrganizationPlanCommand.UpgradePlanAsync (cognitive 63) finding(s) in Cognitive Complexity — start with UpgradeOrganizationPlanCommand.cs. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 Context.LoadConfiguration (cognitive 61) finding(s) in Cognitive Complexity — start with Context.cs. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 CoreHelpers.BuildIdentityClaims (cognitive 57) finding(s) in Cognitive Complexity — start with CoreHelpers.cs. — One of this dimension's main actionable groups (1 warning-level).
- Enforce Cognitive Complexity in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D3 · God Classes
32 god class(es) detected.
TooManyMethods: HostBuilderExtensions root/.nuget/packages/bitwarden.server.sdk/1.5.2/Content/HostBuilderExtensions.cs:0
FileTooLong: Controllers/OrganizationsController.cs src/Admin/AdminConsole/Controllers/OrganizationsController.cs:0
ClassTooLong: OrganizationsController src/Admin/AdminConsole/Controllers/OrganizationsController.cs:0
Do you agree with this assessment?
D4 · Code Duplication
65 duplicated block group(s) detected.
Duplicated block (11 lines × 2) src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/AutoConfirmUser/AutomaticallyConfirmOrganizationUserCommand.cs:151
Duplicated block (8 lines × 2) src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyEventHandlers/SingleOrgPolicyEventHandler.cs:76
Duplicated block (13 lines × 2) src/Core/AdminConsole/OrganizationFeatures/Groups/CreateGroupCommand.cs:85
Duplicated block (12 lines × 2) src/Admin/AdminConsole/Controllers/OrganizationsController.cs:180
Duplicated block (9 lines × 2) src/Api/Utilities/ExceptionHandlerFilterAttribute.cs:167
Do you agree with this assessment?
D5 · Coupling
57 projects, 0 dependency cycle(s), 0 unstable depended-on project(s).
Off the main sequence: AppHost
Do you agree with this assessment?
D6 · Cohesion (LCOM4)
35 of 506 classes have LCOM4 above 3.
Low cohesion: OrganizationUserRepository (LCOM4 34) src/Infrastructure.Dapper/AdminConsole/Repositories/OrganizationUserRepository.cs:21
Do you agree with this assessment?
D8 · Code Coverage
Line coverage 66.3%.
Do you agree with this assessment?
D9 · Test Distribution
7709 test methods: 7677 unit, 32 integration, 0 BDD, 0 e2e.
Unit tests
Integration tests
BDD tests
E2E tests
Do you agree with this assessment?
D10 · Test Quality
49 skipped (47 with a documented reason), 72 zero-assertion, 15 mock references across 7709 tests (1 harness-style project(s) excluded from the assertion penalty).
No assertions: UpdateAsync_Success bitwarden_license/test/Commercial.Core.Test/AdminConsole/Services/ProviderServiceTests.cs:169
Skipped test: GetIconAsync_Success test/Icons.Test/Services/IconFetchingServiceTests.cs:8
No direct assertions: Post_UserClientExportedVault_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:57
Skipped (documented): ExternalCallback_WithInvalidProviderGuid_ReturnsError bitwarden_license/test/Sso.IntegrationTest/Controllers/AccountControllerTests.cs:613
Mock framework: NSubstitute
Do you agree with this assessment?
D11 · Test Reliability
0 flaky across 1 measured tier(s). integration: measured (0 flaky); other: not included — too large to re-run within its budget.
Tier not included (time budget)
Do you agree with this assessment?
D12 · Dependency Hygiene
267 outdated, 3 vulnerable, 24 deprecated packages.
Vulnerable: AutoMapper
Deprecated: xunit
Outdated: Aspire.Hosting.AppHost
What to do
- Resolve the 24 Deprecated finding(s) in Dependency Hygiene. — One of this dimension's main actionable groups (24 warning-level).
- Resolve the 3 Vulnerable finding(s) in Dependency Hygiene. — One of this dimension's main actionable groups (3 issue-level).
- Enforce Dependency Hygiene in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Verified — provenance only; does not change the score.
Do you agree with this assessment?
D13 · Secret Scanning
Secret scan ran and found no leaked secrets.
Do you agree with this assessment?
D15 · Churn × Complexity Hotspots
No churn × complexity hotspots in the window.
git history depth insufficient
Do you agree with this assessment?
D17 · Explicit Debt
1171 deducted debt markers + 0 dead symbols across 174039 LoC (1.1/KLoC) → score 7.8.
NoWarnInCsproj src/Core/Core.csproj:11
EmptyCatchBlock src/Api/Utilities/ApiHelpers.cs:26
FixmeComment src/Admin/AdminConsole/Controllers/OrganizationsController.cs:1
TodoComment src/Admin/HostedServices/AzureQueueMailHostedService.cs:87
ObsoleteWithCallers src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:678
What to do
- Resolve the 18 NoWarnInCsproj finding(s) in Explicit Debt — start with Core.csproj (8), Api.csproj (6), Setup.csproj (4). — One of this dimension's main actionable groups (18 issue-level).
- Resolve the 2 EmptyCatchBlock finding(s) in Explicit Debt — start with ApiHelpers.cs, ApplicationCacheHostedService.cs. — One of this dimension's main actionable groups (2 issue-level).
- Resolve the 695 FixmeComment finding(s) in Explicit Debt — start with AccountController.cs (7), GroupsController.cs (3), OrganizationsController.cs (3). — One of this dimension's main actionable groups (695 warning-level).
- Enforce Explicit Debt in CI to reach Verified (currently Documented). — Hardens enforcement from Documented toward Prevented — provenance only; does not change the score.
Do you agree with this assessment?
D18 · Solution Shape
57 projects, 4827 .cs files, 397882 hand-written lines of code (174039 production / 223843 test), plus 847170 generated (EF migrations / designer / snapshots, excluded from quality), 278 inter-project edges (build failed).
Build did not complete in the analyzer
AppHost (Production)AppHost/AppHost.csproj
MicroBenchmarks (Production)perf/MicroBenchmarks/MicroBenchmarks.csproj
Admin (Production)src/Admin/Admin.csproj
Api (Production)src/Api/Api.csproj
Do you agree with this assessment?
D20 · ADR Quality
No architecture decision records were found.
No ADRs found
What to do
- Resolve the 1 No ADRs found finding(s) in ADR Quality. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D22 · Internal API Consistency
No public API surface exposed; nothing to be inconsistent.
No exposed public API
Do you agree with this assessment?
D27 · Navigability
86 % of calls cross a namespace and 25 % go through an interface, but 100 % of collaborators are co-located — so following a call takes several hops. Baseline: large — vertical-slice locality expected.
What to do
- Improve Navigability — currently 6.3/10. — 86 % of calls cross a namespace and 25 % go through an interface, but 100 % of collaborators are co-located — so following a call takes several hops. Baseline: large — vertical-slice locality expected.
Do you agree with this assessment?
D28 · Secrets (history)
3 finding(s): 0 critical, 3 high, 0 medium, 0 low. Remediation is credential rotation — the secrets remain in history regardless of later deletion.
Secret: jwt src/Core/Settings/GlobalSettings.cs:516
Rotate the exposed credentials — git history can't be un-committed
What to do
- Resolve the 3 Secret finding(s) in Secrets (history) — start with GlobalSettings.cs, SshKeyDataGenerator.cs, rsa_keys.rs. — One of this dimension's main actionable groups (3 issue-level).
- Resolve the 1 Rotate the exposed credentials finding(s) in Secrets (history). — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D29 · Static Analysis (SAST)
semgrep found no security issues.
Do you agree with this assessment?
D30 · Dependency Vulnerabilities
4 vulnerable package(s): 0 critical, 4 high, 0 medium, 0 low.
High CVE: MessagePack 2.5.192
What to do
- Resolve the 4 High CVE finding(s) in Dependency Vulnerabilities. — One of this dimension's main actionable groups (4 issue-level).
Do you agree with this assessment?
D31 · IaC & Container Security
20 finding(s): 0 critical, 18 high, 0 medium, 2 low.
High IaC: DS-0002 bitwarden_license/src/Scim/Dockerfile
Low IaC: DS-0026 util/MsSqlMigratorUtility/Dockerfile
What to do
- Resolve the 18 High IaC finding(s) in IaC & Container Security — start with Dockerfile (18). — One of this dimension's main actionable groups (18 issue-level).
- Resolve the 2 Low IaC finding(s) in IaC & Container Security — start with Dockerfile (2). — One of this dimension's main actionable groups (2 recommendation-level).
Do you agree with this assessment?
D33 · JS/npm Dependency Vulnerabilities
16 finding(s): 0 critical, 11 high, 5 medium, 0 low.
High CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
Medium CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
What to do
- Resolve the 11 High CVE finding(s) in JS/npm Dependency Vulnerabilities — start with package-lock.json (11). — One of this dimension's main actionable groups (11 issue-level).
- Resolve the 5 Medium CVE finding(s) in JS/npm Dependency Vulnerabilities — start with package-lock.json (5). — One of this dimension's main actionable groups (5 warning-level).
Do you agree with this assessment?
D36 · Supply-chain Provenance & Signing
1/4 supply-chain integrity signals present (provenance, signing, SBOM, pinned actions).
Unpinned build actions
No build provenance
No SBOM
What to do
- Resolve the 1 Unpinned build actions finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 warning-level).
- Resolve the 1 No build provenance finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 recommendation-level).
- Resolve the 1 No SBOM finding(s) in Supply-chain Provenance & Signing. — One of this dimension's main actionable groups (1 recommendation-level).
Do you agree with this assessment?
D37 · Vulnerability-disclosure Policy
A vulnerability-disclosure policy (SECURITY.md) is published with a reporting contact.
Do you agree with this assessment?
D38 · OSV Dependency Vulnerabilities
39 finding(s): 0 critical, 22 high, 15 medium, 2 low.
High CVE: [GHSA redacted] bitwarden_license/src/Sso/package-lock.json
Medium CVE: [GHSA redacted] bitwarden_license/src/Sso/package-lock.json
Low CVE: [GHSA redacted] util/RustSdk/rust/Cargo.lock
What to do
- Resolve the 22 High CVE finding(s) in OSV Dependency Vulnerabilities — start with package-lock.json (22). — One of this dimension's main actionable groups (22 issue-level).
- Resolve the 15 Medium CVE finding(s) in OSV Dependency Vulnerabilities — start with package-lock.json (13), Cargo.lock (2). — One of this dimension's main actionable groups (15 warning-level).
- Resolve the 2 Low CVE finding(s) in OSV Dependency Vulnerabilities — start with Cargo.lock (2). — One of this dimension's main actionable groups (2 recommendation-level).
Do you agree with this assessment?
Frontend & cross-cutting dimensions
AC2 · Forms & labels
- This control has no associated label. Add a <label for> / wrapping <label> / aria-label / aria-labelledby so assistive tech can name it. (×3) — _OrganizationForm.cshtml:36, _OrganizationForm.cshtml:40, Index.cshtml:21
- This control has only a placeholder — a placeholder is not a label (it vanishes on input and many AT ignore it). Add a <label for>, a wrapping <label>, or aria-label. — Index.cshtml:19
What to do
- Give every control a programmatic label (a <label for> / wrapping <label> / aria-label) and every button text — a placeholder is not a label.
Do you agree with this assessment?
AC3 · Page structure
- A page with no <title> gives no name in the tab, history or screen-reader page list. Add a descriptive <title> in <head>. (×3) — _Layout.cshtml:0, _Layout.cshtml:0, Redirect.cshtml:0
- No <main> (or role="main") means no "skip to content" target and a weaker landmark map. Wrap the primary content in <main>. (×2) — _Layout.cshtml:0, Redirect.cshtml:0
- Skipping heading levels breaks the document outline assistive tech relies on. Don't jump levels — increase by at most one. (×2) — Edit.cshtml:157, Edit.cshtml:28
- The page declares no language, so assistive tech can't pick the right pronunciation. Add lang (e.g. lang="en"). (×2) — _Layout.cshtml:0, Redirect.cshtml:0
What to do
- Declare <html lang>, a document <title> and a <main> landmark, keep headings in order, leave zoom enabled, title iframes and drop meta-refresh.
Do you agree with this assessment?
AC5 · ARIA correctness
Do you agree with this assessment?
AC6 · Visual & motion safety
Do you agree with this assessment?
AC7 · A11y enforcement
- No accessibility enforcement found — no a11y linter (eslint-plugin-jsx-a11y / vuejs-accessibility) and no axe/pa11y/Lighthouse in tests or CI. Start with the linter to catch issues at author time.
What to do
- Enforce accessibility in the toolchain: add eslint-plugin-jsx-a11y (or vuejs-accessibility), assert with jest-axe / playwright-axe in tests, then gate axe/pa11y/Lighthouse in CI.
Do you agree with this assessment?
AX1 · Captive dependencies
- `LicensingService` is registered as a SINGLETON but its constructor takes `ILicenseClaimsFactory organizationLicenseClaimsFactory`, which is registered as Transient. The singleton captures one instance of the transient dependency forever — defeating its lifetime (a per-request DbContext shared across all requests is a classic data-corruption/threading bug). Make the singleton resolve `ILicenseClaimsFactory` per-use (inject `IServiceScopeFactory` or a factory func), or align the lifetimes. — LicensingService.cs:32
- `LicensingService` is registered as a SINGLETON but its constructor takes `ILicenseClaimsFactory userLicenseClaimsFactory`, which is registered as Transient. The singleton captures one instance of the transient dependency forever — defeating its lifetime (a per-request DbContext shared across all requests is a classic data-corruption/threading bug). Make the singleton resolve `ILicenseClaimsFactory` per-use (inject `IServiceScopeFactory` or a factory func), or align the lifetimes. — LicensingService.cs:32
What to do
- Don't inject scoped/transient services into singletons; resolve them per-use via IServiceScopeFactory or a factory delegate, or align the lifetimes.
Do you agree with this assessment?
AX10 · Code composition
What to do
- The domain core is a small share of production code — check that business logic isn't leaking into the application/infrastructure layers (a thin domain is the anemic-domain smell).
Do you agree with this assessment?
AX2 · Stateful singletons
- `JobsHostedService` is a singleton (one shared instance) but mutates instance state outside any lock (_adHocScheduler; e.g. `_adHocScheduler` at line 56). — JobsHostedService.cs:8
- `InMemoryApplicationCacheService` is a singleton (one shared instance) but mutates instance state outside any lock (_providerAbilities, _orgAbilities, _lastOrgAbilityRefresh; e.g. `_providerAbilities` at line 81). (×2) — InMemoryApplicationCacheService.cs:14, InMemoryApplicationCacheService.cs:14
- `ConnectionCounter` is a singleton (one shared instance) but mutates instance state outside any lock (_count; e.g. `_count` at line 19). — ConnectionCounter.cs:3
- `HandlebarsMailService` is a singleton (one shared instance) but mutates instance state outside any lock (_templateCache, _registeredHelpersAndPartials; e.g. `_templateCache` at line 924). — HandlebarsMailService.cs:36
- `LicensingService` is a singleton (one shared instance) but mutates instance state outside any lock (_userCheckCache; e.g. `_userCheckCache` at line 244). — LicensingService.cs:32
- `AzureAttachmentStorageService` is a singleton (one shared instance) but mutates instance state outside any lock (_attachmentContainers; e.g. `_attachmentContainers` at line 268). — AzureAttachmentStorageService.cs:13
- `AzureSendFileStorageService` is a singleton (one shared instance) but mutates instance state outside any lock (_sendFilesContainerClient; e.g. `_sendFilesContainerClient` at line 196). — AzureSendFileStorageService.cs:16
- `AzureOrganizationReportStorageService` is a singleton (one shared instance) but mutates instance state outside any lock (_containerClient; e.g. `_containerClient` at line 133). — AzureOrganizationReportStorageService.cs:12
- `GlobalSettings` is a singleton (one shared instance) but mutates instance state outside any lock (_licenseDirectory, _mailTemplateDirectory; e.g. `_licenseDirectory` at line 33). — GlobalSettings.cs:10
- `DynamicAuthenticationSchemeProvider` is a singleton (one shared instance) but mutates instance state outside any lock (_schemesCopy, _handlerSchemesCopy, _lastSchemeLoad, _cachedSchemes, _cachedHandlerSchemes; e.g. `_schemesCopy` at line 180). — DynamicAuthenticationSchemeProvider.cs:27
What to do
- Keep singletons stateless or back their state with thread-safe types (Concurrent*/Immutable*); otherwise concurrent callers race.
Do you agree with this assessment?
AX3 · Project dependency cycles
Do you agree with this assessment?
AX4 · Dependency direction
Do you agree with this assessment?
AX5 · Architecture & structure
Do you agree with this assessment?
AX6 · Interface segregation
- `IStripeFacade` declares 21 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IStripeFacade.cs:9
- `IProfileOrganizationDetails` declares 147 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IProfileOrganizationDetails.cs:10
- `IProviderService` declares 17 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IProviderService.cs:12
- `ICurrentContext` declares 75 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — ICurrentContext.cs:21
- `ISubscriber` declares 21 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — ISubscriber.cs:7
- `IEvent` declares 66 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IEvent.cs:8
- `IMailQueueMessage` declares 18 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IMailQueueMessage.cs:3
- `ICollectionRepository` declares 18 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — ICollectionRepository.cs:8
- `IOrganizationRepository` declares 22 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IOrganizationRepository.cs:12
- `IOrganizationUserRepository` declares 43 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IOrganizationUserRepository.cs:14
- `IUserRepository` declares 25 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IUserRepository.cs:9
- `IOrganizationService` declares 18 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IOrganizationService.cs:13
- `IEventService` declares 28 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IEventService.cs:15
- `IMailService` declares 68 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IMailService.cs:15
- `IAttachmentStorageService` declares 16 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IAttachmentStorageService.cs:8
- `IUserService` declares 47 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IUserService.cs:16
- `IGrant` declares 30 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IGrant.cs:6
- `IEmergencyAccessService` declares 18 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IEmergencyAccessService.cs:13
- `IBaseServiceUriSettings` declares 55 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IBaseServiceUriSettings.cs:4
- `IGlobalSettings` declares 90 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IGlobalSettings.cs:5
- `ILicense` declares 33 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — ILicense.cs:5
- `IStripeAdapter` declares 52 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IStripeAdapter.cs:11
- `IStripePaymentService` declares 16 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IStripePaymentService.cs:13
- `IIntegrationListenerConfiguration` declares 18 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IIntegrationListenerConfiguration.cs:5
- `ICipherRepository` declares 35 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — ICipherRepository.cs:11
- `ICipherService` declares 25 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — ICipherService.cs:5
- `IPushNotificationService` declares 25 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — IPushNotificationService.cs:22
- `ISecretRepository` declares 19 members. A wide interface forces every implementer and caller to depend on methods they don't use (the Interface-Segregation 'I' in SOLID). Split it into focused role-interfaces. — ISecretRepository.cs:11
What to do
- Split fat interfaces into focused role-interfaces so clients depend only on what they use.
Do you agree with this assessment?
AX8 · Test isolation
Do you agree with this assessment?
AX9 · CQS / query purity
Do you agree with this assessment?
C1 · Data Protection
- No in-app HTTPS enforcement, but ForwardedHeaders / 127.0.0.1 binding indicates a reverse-proxy topology — adding UseHttpsRedirection in the app would be wrong in this layout. Verify the reverse proxy enforces TLS. — Startup.cs:146
What to do
- Strengthen data-at-rest protection: vault your keys (Azure Key Vault / AWS KMS / IDataProtector key ring) and encrypt the most sensitive columns (EF HasConversion encryption or provider-native column encryption) — partial coverage still leaves gaps.
Do you agree with this assessment?
C2 · Access Controls
Do you agree with this assessment?
C4 · Data Retention
Do you agree with this assessment?
C5 · Data-Subject Rights
- Corroborated rights: erasure ✓ · export ✗ · consent ✗. The missing right(s) would have to be fulfilled manually.
What to do
- Implement data export/portability for a data subject (a machine-readable export of their personal data).
- Track GDPR consent (lawful basis) alongside the personal data it authorises.
Do you agree with this assessment?
ED3 · Event naming
- `IntegrationMessage` reads as an instruction, not a fact that happened. Events describe something that already occurred — name them in the past tense (e.g. `OrderPlaced`, `PaymentCaptured`) so the ubiquitous language stays clear. (×2) — IntegrationMessage.cs:6, IntegrationMessage.cs:32
What to do
- Name events in the past tense — they record facts that already happened.
Do you agree with this assessment?
ED4 · Outbox / dual-write
Do you agree with this assessment?
GD1 · Unfinished & placeholder code
- A shipped member still throws NotImplementedException — generated scaffolding that was never completed. Implement it or remove the dead surface. (×25) — HomeController.cs:61, ReadOnlyIdentityUserStore.cs:17, ReadOnlyIdentityUserStore.cs:23, …
What to do
- Finish or delete NotImplementedException stubs and replace placeholder literals before shipping.
Do you agree with this assessment?
IC1 · Incompleteness & stubs
- `StopAsync` looks like it should compute a result but its body just returns a constant — a placeholder return that was never filled in. — DatabaseMigrationHostedService.cs:50
- `CreateAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — ReadOnlyIdentityUserStore.cs:14
- `DeleteAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — ReadOnlyIdentityUserStore.cs:20
- `SetEmailAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — ReadOnlyIdentityUserStore.cs:74
- `SetEmailConfirmedAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — ReadOnlyIdentityUserStore.cs:80
- `SetUserNameAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — ReadOnlyIdentityUserStore.cs:100
- `SetSecurityStampAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — ReadOnlyIdentityUserStore.cs:112
- `ToOrganizationUser` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — MemberCreateRequestModel.cs:26
- `OnResourceExecuted` takes parameters but its body is empty — it accepts inputs and does nothing. Either implement it or remove it. — DisableFormValueModelBindingAttribute.cs:17
- `GetFundingBankTransferTypeAsync` is declared `async` but never awaits anything, so it runs synchronously while pretending to be asynchronous. Drop `async` or do the real async work. — StripeEventUtilityService.cs:436
- `NotifyOrganizationAbilityUpsertedAsync` looks like it should compute a result but its body just returns a constant — a placeholder return that was never filled in. — NoOpApplicationCacheMessaging.cs:7
- `NotifyOrganizationAbilityDeletedAsync` looks like it should compute a result but its body just returns a constant — a placeholder return that was never filled in. — NoOpApplicationCacheMessaging.cs:12
- `NotifyProviderAbilityDeletedAsync` looks like it should compute a result but its body just returns a constant — a placeholder return that was never filled in. — NoOpApplicationCacheMessaging.cs:17
- `NoopProviderService` has 18 unfinished members out of 18 — a scaffolded type that was never implemented. — NoopProviderService.cs:12
- `CompleteSetupAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:14
- `UpdateAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:16
- `InviteUserAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:18
- `ResendInvitesAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:20
- `AcceptUserAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:22
- `ConfirmUsersAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:24
- `SaveUserAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:26
- `DeleteUsersAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:28
- `AddOrganization` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:30
- `AddOrganizationsToReseller` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:32
- `CreateOrganizationAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:34
- `RemoveOrganizationAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:36
- `LogProviderAccessToOrganizationAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:38
- `ResendProviderSetupInviteEmailAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:40
- `SendProviderSetupInviteEmailAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:41
- `InitiateDeleteAsync` is a shipped member whose whole body throws NotImplementedException — scaffolding that was never completed. Implement it or remove the dead surface. — NoopProviderService.cs:42
What to do
- Finish or delete the unfinished stubs (NotImplementedException / empty / constant-returning bodies) — they are dead surface that looks live.
- Clear the softer debt: remove commented-out code and dead branches, re-enable or delete skipped tests, and replace blanket warning suppressions with targeted ones.
Do you agree with this assessment?
M1 · Documentation (README)
What to do
- Add a build/run (quick start) section to the root README — the first thing a newcomer needs.
- Add a 'Testing' section to the root README — how to run the test suite.
- Add an 'Architecture' / 'How it works' section to the root README — the high-level shape.
- Add a README to the 47 of 57 project(s) that lack one — worth up to 1.6 pts.
Do you agree with this assessment?
M2 · Architecture documentation
- No Architecture Decision Records found — decisions aren't captured for future maintainers.
What to do
- Start an ADR log (docs/adr/) recording significant decisions and their rationale.
Do you agree with this assessment?
M3 · Folder & project structure
Do you agree with this assessment?
P1 · CI/CD gates
Do you agree with this assessment?
P2 · Observability
- Only 21/28 service-like projects use logging (pure contract/DTO projects are excluded — they have nothing to log).
What to do
- Extend structured logging to the remaining service-like projects so the whole executable surface is diagnosable in production.
Do you agree with this assessment?
P3 · Security & performance tooling
What to do
- Enable Dependabot/Renovate or a dependency-review gate.
- Add gitleaks/trufflehog in CI to block PRs that introduce committed secrets.
Do you agree with this assessment?
P4 · Deployment & Rollback
- Deployment automation exists but no readiness/liveness probes, rolling-update strategy, lifecycle hooks or migration job were evidenced — a bad release is harder to detect and reverse.
What to do
- Add readiness/liveness probes and a rolling-update (or blue/green) strategy so a bad release is caught and rolled back automatically.
Do you agree with this assessment?
P5 · DR & Backup
What to do
- Document RTO/RPO and a tested restore procedure (a backup config alone isn't disaster recovery).
Do you agree with this assessment?
P6 · Release Hygiene
- No CHANGELOG/HISTORY/RELEASES file — what shipped when isn't easy to reconstruct for support or audit. (Versioning/tagging makes releases traceable, but a changelog records the what.)
What to do
- Keep a changelog (e.g. Keep-a-Changelog) recording what shipped in each release.
Do you agree with this assessment?
P7 · Outbound HTTP resilience
- The app makes outbound HTTP calls but no resilience handler was detected (Polly / AddStandardResilienceHandler / circuit-breaker). A slow or failing dependency will cascade — add timeouts, retries with back-off, and a circuit breaker.
What to do
- Add `AddStandardResilienceHandler()` (or Polly policies) to your HttpClient registrations so a flaky dependency can't take the app down.
Do you agree with this assessment?
P8 · Schema migrations
Do you agree with this assessment?
P9 · Domain vs controller coverage
- Domain coverage is 23% but the web/controller layer is at 52% — the trivial layer is better tested than the business rules. Coverage effort should concentrate where the invariants and decisions live (the domain), not on thin controllers/endpoints.
What to do
- Shift coverage toward the domain: aim to cover aggregates/domain services above the web layer, since that's where the costly bugs are.
Do you agree with this assessment?
PF1 · Benchmark discipline
Do you agree with this assessment?
PF2 · Allocation hygiene
What to do
- Raise allocation-aware density on the hot paths — currently 12 use(s) across 1,022,061 production line(s) (~0.0/1k). More Span/Memory, pooling (ArrayPool/ObjectPool), stackalloc and ValueTask on the allocation-heavy paths climbs this toward 10.
Do you agree with this assessment?
PF3 · Async & latency hygiene
- 9 blocking call(s) on async work (.Wait()/.GetAwaiter().GetResult()) — these waste a thread and can deadlock in a consumer with a synchronization context.
What to do
- Make the call chain async end-to-end and await it — never block on a Task with .Wait()/.GetAwaiter().GetResult() in library code.
Do you agree with this assessment?
S1 · Web-Security Posture
- Password-hash field compared with `==` — use a constant-time compare to avoid timing oracles (CryptographicOperations.FixedTimeEquals). — RegisterFinishRequestModel.cs:170
What to do
- Compare password hashes with `CryptographicOperations.FixedTimeEquals` (constant time, no timing oracle).
Do you agree with this assessment?
X1 · Async correctness
- Blocking on a Task with `.Wait()`/`.GetAwaiter().GetResult()` can deadlock (and wastes a thread). Make the caller `async` and `await` instead. (×9) — LicensingService.cs:76, LicensingService.cs:80, LicensingService.cs:93, …
What to do
- Sync-over-async (deadlock risk)
Do you agree with this assessment?
X2 · Cancellation propagation
- Only 66/3078 async methods accept a CancellationToken, so requests can't be cancelled cleanly under load or on client disconnect. In Blazor Server circuits and other short-write hosts, omitting it can be an accepted convention — judge against your hosting model.
- No CancellationToken parameter — work can't be cancelled cleanly on disconnect/shutdown. (×25) — PersistedGrantStoreTests.cs:91, OrganizationsController.cs:147, OrganizationsController.cs:177, …
What to do
- Thread a CancellationToken through async methods so work stops promptly on cancellation.
Do you agree with this assessment?
X3 · Exception handling
- An empty catch block silently discards the error — failures vanish with no log and no rethrow. Log it, handle it, or don't catch it. (×2) — ApiHelpers.cs:26, ApplicationCacheHostedService.cs:89
What to do
- Swallowed exception (empty catch)
Do you agree with this assessment?
X4 · Structured logging
Do you agree with this assessment?
X5 · Nullable reference types
- ~0.1 `!` suppressions per 1k syntax nodes — each one tells the compiler to trust you about null, suppressing the very safety NRTs provide.
What to do
- Enable <Nullable>enable</Nullable> across all projects and resolve warnings rather than suppressing with `!`.
Do you agree with this assessment?
WCAG coverage — what static analysis assessed
| Dimension | WCAG 2.2 A/AA criteria | Coverage |
|---|---|---|
| AC2 · Forms & labels | 1.3.1, 3.3.2, 4.1.2 | Partial signal |
| AC3 · Page structure | 1.4.4, 2.2.1, 2.4.1, 2.4.2, 3.1.1, 4.1.2 | Partial signal |
| AC5 · ARIA correctness | 4.1.2 | Partial signal |
| AC6 · Visual & motion safety | 1.4.3, 2.4.7 | Partial — literal CSS only |
| AC7 · A11y enforcement | enforcement — no page criterion | Enforcement posture (process) |
Reference — by lens
| Lens | Score | Rating | Impact |
|---|---|---|---|
| Code Health | 61% | Fair — gated by IC1 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Architecture | 83% | Healthy | Solid. |
| Maturity | 72% | Healthy | Solid. |
| Readiness | 42% | Poor — gated by D12, P7, P9 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Security | 63% | Fair — gated by D31, D33, D36, D38 | Capped at Fair by a Critical contributor — resolve it before relying on this lens. |
| Event-Driven | 100% | Exemplary | Strongest area. |
| Accessibility | 65% | Fair | Acceptable, with room to improve. |
| Performance | 67% | Fair | Acceptable, with room to improve. |
Not included — 25 check(s) not relevant to this codebase
- AC1 Text alternatives — No image/media element found in the parsed markup — AC1 not applicable here.
- AC4 Keyboard semantics — No interactive element found in the parsed markup — AC4 not applicable here.
- AX7 Slice cohesion — not applicable — not a vertical-slice architecture
- C3 Audit Trail — Repo shows no audit-logging mechanism (IAuditable, an immutable audit log, an EF SaveChanges interceptor) for sensitive changes — absence of evidence is not evidence of a working control. Record an audit trail in code (or document where it lives) so this dimension can be scored.
- D14 License Compliance — License scan unavailable
- D16 Bus Factor — single-maintainer — knowledge-concentration (bus factor) risk
- D19 Documentation Quality — LLM evaluation failed
- D21 Naming Consistency — LLM evaluation failed
- D23 Boundary Type-Coupling — Dimension evaluation failed
- D24 Comment Value — LLM evaluation failed
- D25 ADR Conformance — no ADRs to check
- D26 Project Cohesion — Dimension evaluation failed
- D32 Data Compliance (PII/GDPR) — Not applicable
- D34 Knowledge Freshness — early-stage repository — too little history to judge knowledge freshness
- D35 Change Coupling — no production change history to mine for change-coupling
- D7 Architectural Integrity — No checkable ADRs to assess
- DM1 Domain Modelling — not run — only 2/3 markers (18 value object(s); a Domain/Aggregates/ValueObjects layer)
- ED1 Handler temporal coupling — no event handlers detected — temporal-coupling check not applicable
- ED2 Event/command shape — no command-shaped messages detected — single-handler-per-command check not applicable
- ED5 Idempotency — no mutating command handlers or message consumers detected — idempotency check not applicable
- ES1 Event Sourcing — not run — 0/3 markers found
- M4 Documentation accuracy — LLM accuracy check could not reach the model — accuracy is advisory and stays neutral.
- P12 CI test-gate honesty — no data
- X6 Hand-rolled structured-format parsing — no data
- X7 Silent fallback defaults — no data
Appendix A — Findings (grouped)
Issue — 135 finding(s)
D10 · Test Quality
- No assertions: UpdateAsync_Success bitwarden_license/test/Commercial.Core.Test/AdminConsole/Services/ProviderServiceTests.cs:169
- No assertions: Handler_SupportedProjectOperationRequirement_DoesNotThrow bitwarden_license/test/Commercial.Core.Test/SecretsManager/AuthorizationHandlers/Projects/ProjectAuthorizationHandlerTests.cs:74
- No assertions: Handler_SupportedSecretOperationRequirement_Throws bitwarden_license/test/Commercial.Core.Test/SecretsManager/AuthorizationHandlers/Secrets/SecretAuthorizationHandlerTests.cs:75
- No assertions: Handler_SupportedServiceAccountOperationRequirement_DoesNotThrow bitwarden_license/test/Commercial.Core.Test/SecretsManager/AuthorizationHandlers/ServiceAccounts/ServiceAccountAuthorizationHandlerTests.cs:68
- No assertions: ValidateAdminRequest_UserHasManageResetPasswordPermissions_DoesNotThrow test/Api.Test/AdminConsole/Controllers/OrganizationAuthRequestsControllerTests.cs:29
- No assertions: UpdateManyAuthRequests_ValidInput_DoesNotThrow test/Api.Test/AdminConsole/Controllers/OrganizationAuthRequestsControllerTests.cs:40
- No assertions: ConnectionEnabled_RequiresBothSelfHostAndCommunications test/Api.Test/AdminConsole/Controllers/OrganizationConnectionsControllerTests.cs:33
- No assertions: DeleteConnection_Success test/Api.Test/AdminConsole/Controllers/OrganizationConnectionsControllerTests.cs:398
- No assertions: PostKdf_ChangeKdfSuccess_NoError test/Api.Test/Auth/Controllers/AccountsControllerTests.cs:723
- No assertions: CheckForDistinctAccessPolicies_DistinctPolicies_Success test/Api.Test/SecretsManager/Utilities/AccessPolicyHelpersTests.cs:53
- No assertions: CheckAccessPoliciesHaveReadPermission_AllReadIsTrue_Success test/Api.Test/SecretsManager/Utilities/AccessPolicyHelpersTests.cs:88
- No assertions: SendEmailAsync_Succeeds_WhenCertIsSelfSigned_ServerIsTrusted test/Core.IntegrationTest/MailKitSmtpMailDeliveryServiceTests.cs:118
- No assertions: SendEmailAsync_Succeeds_WhenServerNeedsToAuthenticate test/Core.IntegrationTest/MailKitSmtpMailDeliveryServiceTests.cs:246
- No assertions: Process_NoProcessors_Handled test/Core.Test/AdminConsole/OrganizationAuth/Models/BatchAuthRequestUpdateProcessorTests.cs:14
- No assertions: SignUpOrganizationAsync_WithTrialLengthAtMinimum_Succeeds test/Core.Test/AdminConsole/OrganizationFeatures/Organizations/OrganizationSignUp/CloudOrganizationSignUpCommandTests.cs:409
- No assertions: SignUpOrganizationAsync_WithTrialLengthAtMaximum_Succeeds test/Core.Test/AdminConsole/OrganizationFeatures/Organizations/OrganizationSignUp/CloudOrganizationSignUpCommandTests.cs:435
- No assertions: SignUpOrganizationAsync_WithoutTrialLength_Succeeds test/Core.Test/AdminConsole/OrganizationFeatures/Organizations/OrganizationSignUp/CloudOrganizationSignUpCommandTests.cs:461
- No assertions: InviteUsers_WithCustomType_WhenUseCustomPermissionsIsTrue_Passes test/Core.Test/AdminConsole/Services/OrganizationServiceTests.cs:187
- No assertions: InviteUsers_WithNonCustomType_WhenUseCustomPermissionsIsFalse_Passes test/Core.Test/AdminConsole/Services/OrganizationServiceTests.cs:223
- No assertions: InviteUsers_NoPermissionsObject_Passes test/Core.Test/AdminConsole/Services/OrganizationServiceTests.cs:319
- No assertions: ValidateSecretsManagerPlan_ValidPlan_NoExceptionThrown test/Core.Test/AdminConsole/Services/OrganizationServiceTests.cs:948
- No assertions: ValidateOrganizationUserUpdatePermissions_WithCustomPermission_WhenSavingUserHasCustomPermission_Passes test/Core.Test/AdminConsole/Services/OrganizationServiceTests.cs:970
- No assertions: ValidateOrganizationCustomPermissionsEnabledAsync_WithNotCustomType_IsValid test/Core.Test/AdminConsole/Services/OrganizationServiceTests.cs:1058
- No assertions: ValidateOrganizationCustomPermissionsEnabledAsync_WithUseCustomPermissionsEnabled_IsValid test/Core.Test/AdminConsole/Services/OrganizationServiceTests.cs:1095
- No assertions: RunCanGenerateTwoFactorTokenAsync test/Core.Test/Auth/Identity/AuthenticationTwoFactorTokenProviderTests.cs:32
D38 · OSV Dependency Vulnerabilities
- High CVE: [GHSA redacted] bitwarden_license/src/Sso/package-lock.json
- High CVE: [GHSA redacted] bitwarden_license/src/Sso/package-lock.json
- High CVE: [GHSA redacted] bitwarden_license/src/Sso/package-lock.json
- High CVE: [GHSA redacted] src/Admin/package-lock.json
- High CVE: [GHSA redacted] src/Admin/package-lock.json
- High CVE: [GHSA redacted] src/Admin/package-lock.json
- High CVE: [GHSA redacted] src/Admin/package-lock.json
- High CVE: [GHSA redacted] src/Admin/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
D17 · Explicit Debt
- NoWarnInCsproj src/Core/Core.csproj:11
- NoWarnInCsproj src/Core/Core.csproj:11
- NoWarnInCsproj src/Core/Core.csproj:11
- NoWarnInCsproj src/Core/Core.csproj:11
- NoWarnInCsproj src/Core/Core.csproj:15
- NoWarnInCsproj src/Core/Core.csproj:15
- NoWarnInCsproj src/Core/Core.csproj:15
- NoWarnInCsproj src/Core/Core.csproj:15
- NoWarnInCsproj src/Api/Api.csproj:14
- NoWarnInCsproj src/Api/Api.csproj:14
- NoWarnInCsproj src/Api/Api.csproj:14
- NoWarnInCsproj src/Api/Api.csproj:18
- NoWarnInCsproj src/Api/Api.csproj:18
- NoWarnInCsproj src/Api/Api.csproj:18
- NoWarnInCsproj util/Setup/Setup.csproj:5
- NoWarnInCsproj util/Setup/Setup.csproj:5
- NoWarnInCsproj util/Setup/Setup.csproj:5
- NoWarnInCsproj util/Setup/Setup.csproj:5
D31 · IaC & Container Security
- High IaC: DS-0002 bitwarden_license/src/Scim/Dockerfile
- High IaC: DS-0002 bitwarden_license/src/Sso/Dockerfile
- High IaC: DS-0002 src/Admin/Dockerfile
- High IaC: DS-0002 src/Api/Dockerfile
- High IaC: DS-0002 src/Billing/Dockerfile
- High IaC: DS-0002 src/Events/Dockerfile
- High IaC: DS-0002 src/EventsProcessor/Dockerfile
- High IaC: DS-0002 src/Icons/Dockerfile
- High IaC: DS-0002 src/Identity/Dockerfile
- High IaC: DS-0002 src/Notifications/Dockerfile
- High IaC: DS-0002 util/Attachments/Dockerfile
- High IaC: DS-0002 util/MsSql/Dockerfile
- High IaC: DS-0002 util/MsSqlMigratorUtility/Dockerfile
- High IaC: DS-0002 util/Nginx/Dockerfile
- High IaC: DS-0002 util/SeederApi/Dockerfile
- High IaC: DS-0029 util/SeederApi/Dockerfile
- High IaC: DS-0029 util/SeederApi/Dockerfile
- High IaC: DS-0002 util/Setup/Dockerfile
D33 · JS/npm Dependency Vulnerabilities
- High CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- High CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
D30 · Dependency Vulnerabilities
- High CVE: MessagePack 2.5.192
- High CVE: AutoMapper 14.0.0
- High CVE: SQLitePCLRaw.lib.e_sqlite3 2.1.6
- High CVE: Microsoft.AspNetCore.SignalR.Protocols.MessagePack 10.0.8
D12 · Dependency Hygiene
- Vulnerable: AutoMapper
- Vulnerable: Microsoft.AspNetCore.SignalR.Protocols.MessagePack
- Vulnerable: AutoMapper
D28 · Secrets (history)
- Secret: jwt src/Core/Settings/GlobalSettings.cs:516
- Secret: private-key util/Seeder/Data/Generators/SshKeyDataGenerator.cs:12
- Secret: private-key util/RustSdk/rust/src/rsa_keys.rs:7
D17 · Explicit Debt
- EmptyCatchBlock src/Api/Utilities/ApiHelpers.cs:26
- EmptyCatchBlock src/Core/HostedServices/ApplicationCacheHostedService.cs:89
D23 · Boundary Type-Coupling
- Dimension evaluation failed
D26 · Project Cohesion
- Dimension evaluation failed
Warning — 1431 finding(s)
D17 · Explicit Debt
- FixmeComment src/Admin/AdminConsole/Controllers/OrganizationsController.cs:1
- FixmeComment src/Admin/AdminConsole/Controllers/ProvidersController.cs:1
- FixmeComment src/Admin/AdminConsole/Models/CreateBusinessUnitProviderModel.cs:1
- FixmeComment src/Admin/AdminConsole/Models/CreateMspProviderModel.cs:1
- FixmeComment src/Admin/AdminConsole/Models/CreateResellerProviderModel.cs:1
- FixmeComment src/Admin/AdminConsole/Models/OrganizationEditModel.cs:1
- FixmeComment src/Admin/AdminConsole/Models/OrganizationInitiateDeleteModel.cs:1
- FixmeComment src/Admin/AdminConsole/Models/OrganizationsModel.cs:1
- FixmeComment src/Admin/AdminConsole/Models/OrganizationUnassignedToProviderSearchViewModel.cs:1
- FixmeComment src/Admin/AdminConsole/Models/OrganizationViewModel.cs:1
- FixmeComment src/Admin/AdminConsole/Models/ProviderEditModel.cs:1
- FixmeComment src/Admin/AdminConsole/Models/ProvidersModel.cs:1
- FixmeComment src/Admin/AdminConsole/Models/ProviderViewModel.cs:1
- FixmeComment src/Admin/AdminSettings.cs:1
- FixmeComment src/Admin/Auth/Controllers/LoginController.cs:1
- FixmeComment src/Admin/Auth/Models/LoginModel.cs:1
- FixmeComment src/Admin/Billing/Controllers/ProcessStripeEventsController.cs:1
- FixmeComment src/Admin/Billing/Models/ProcessStripeEvents/EventsFormModel.cs:1
- FixmeComment src/Admin/Billing/Models/ProcessStripeEvents/EventsRequestBody.cs:1
- FixmeComment src/Admin/Billing/Models/ProcessStripeEvents/EventsResponseBody.cs:1
- FixmeComment src/Admin/Controllers/HomeController.cs:1
- FixmeComment src/Admin/Controllers/ToolsController.cs:1
- FixmeComment src/Admin/HostedServices/AzureQueueMailHostedService.cs:1
- FixmeComment src/Admin/IdentityServer/ReadOnlyEnvIdentityUserStore.cs:1
- FixmeComment src/Admin/IdentityServer/ReadOnlyIdentityUserStore.cs:1
D17 · Explicit Debt
- TodoComment src/Admin/HostedServices/AzureQueueMailHostedService.cs:87
- TodoComment src/Admin/HostedServices/DatabaseMigrationHostedService.cs:30
- TodoComment src/Api/AdminConsole/Controllers/OrganizationsController.cs:174
- TodoComment src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:247
- TodoComment src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:736
- TodoComment src/Api/Auth/Controllers/AccountsController.cs:266
- TodoComment src/Api/Auth/Controllers/AccountsController.cs:506
- TodoComment src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs:13
- TodoComment src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs:46
- TodoComment src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs:74
- TodoComment src/Api/Auth/Models/Request/OrganizationSsoRequestModel.cs:142
- TodoComment src/Api/Billing/Controllers/AccountsBillingController.cs:17
- TodoComment src/Api/Billing/Controllers/AccountsBillingController.cs:32
- TodoComment src/Api/Billing/Controllers/AccountsBillingController.cs:51
- TodoComment src/Api/Billing/Controllers/AccountsController.cs:33
- TodoComment src/Api/Billing/Controllers/AccountsController.cs:57
- TodoComment src/Api/Billing/Controllers/OrganizationBillingController.cs:25
- TodoComment src/Api/Billing/Controllers/OrganizationBillingController.cs:46
- TodoComment src/Api/Billing/Controllers/OrganizationBillingController.cs:71
- TodoComment src/Api/Billing/Controllers/OrganizationBillingController.cs:95
- TodoComment src/Api/Billing/Controllers/OrganizationBillingController.cs:119
- TodoComment src/Api/Billing/Controllers/OrganizationBillingController.cs:148
- TodoComment src/Api/Billing/Controllers/ProviderBillingController.cs:35
- TodoComment src/Api/Billing/Controllers/ProviderBillingController.cs:56
- TodoComment src/Api/Billing/Controllers/ProviderBillingController.cs:79
D17 · Explicit Debt
- ObsoleteWithCallers src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:678
- ObsoleteWithCallers src/Api/AdminConsole/Models/Request/Organizations/OrganizationUserResetPasswordRequestModel.cs:15
- ObsoleteWithCallers src/Api/AdminConsole/Models/Request/Organizations/OrganizationUserResetPasswordRequestModel.cs:18
- ObsoleteWithCallers src/Api/AdminConsole/Models/Response/Organizations/OrganizationUserResponseModel.cs:92
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/PasswordRequestModel.cs:12
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/PasswordRequestModel.cs:15
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs:14
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs:18
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs:21
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs:24
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs:27
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs:30
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/SetInitialPasswordRequestModel.cs:33
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/UpdateTdeOffboardingPasswordRequestModel.cs:10
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/UpdateTdeOffboardingPasswordRequestModel.cs:13
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/UpdateTempPasswordRequestModel.cs:10
- ObsoleteWithCallers src/Api/Auth/Models/Request/Accounts/UpdateTempPasswordRequestModel.cs:13
- ObsoleteWithCallers src/Api/Auth/Models/Request/EmergencyAccessRequestModels.cs:50
- ObsoleteWithCallers src/Api/Auth/Models/Request/EmergencyAccessRequestModels.cs:53
- ObsoleteWithCallers src/Api/Auth/Models/Request/OrganizationSsoRequestModel.cs:49
- ObsoleteWithCallers src/Api/Controllers/DevicesController.cs:290
- ObsoleteWithCallers src/Api/Dirt/Controllers/OrganizationIntegrationConfigurationController.cs:82
- ObsoleteWithCallers src/Api/Dirt/Controllers/OrganizationIntegrationController.cs:93
- ObsoleteWithCallers src/Api/KeyManagement/Models/Requests/SetKeyConnectorKeyRequestModel.cs:15
- ObsoleteWithCallers src/Api/KeyManagement/Models/Requests/SetKeyConnectorKeyRequestModel.cs:18
D6 · Cohesion (LCOM4)
- Low cohesion: OrganizationUserRepository (LCOM4 34) src/Infrastructure.Dapper/AdminConsole/Repositories/OrganizationUserRepository.cs:21
- Low cohesion: OrganizationRepository (LCOM4 22) src/Infrastructure.EntityFramework/AdminConsole/Repositories/OrganizationRepository.cs:22
- Low cohesion: OrganizationRepository (LCOM4 21) src/Infrastructure.Dapper/AdminConsole/Repositories/OrganizationRepository.cs:20
- Low cohesion: UserStore (LCOM4 20) src/Core/Auth/Identity/UserStore.cs:13
- Low cohesion: StripeAdapter (LCOM4 19) src/Core/Billing/Services/Implementations/StripeAdapter.cs:16
- Low cohesion: User (LCOM4 14) src/Core/Entities/User.cs:14
- Low cohesion: NoopAttachmentStorageService (LCOM4 14) src/Core/Vault/Services/NoopImplementations/NoopAttachmentStorageService.cs:11
- Low cohesion: UserRepository (LCOM4 13) src/Infrastructure.Dapper/Repositories/UserRepository.cs:20
- Low cohesion: StripeFacade (LCOM4 11) src/Billing/Services/Implementations/StripeFacade.cs:10
- Low cohesion: Organization (LCOM4 11) src/Core/AdminConsole/Entities/Organization.cs:21
- Low cohesion: Provider (LCOM4 11) src/Core/AdminConsole/Entities/Provider/Provider.cs:18
- Low cohesion: ToolsController (LCOM4 10) src/Admin/Controllers/ToolsController.cs:23
- Low cohesion: DeviceRepository (LCOM4 10) src/Infrastructure.EntityFramework/Repositories/DeviceRepository.cs:15
- Low cohesion: DeviceRepository (LCOM4 9) src/Infrastructure.Dapper/Repositories/DeviceRepository.cs:15
- Low cohesion: UserService (LCOM4 8) src/Core/Services/Implementations/UserService.cs:44
- Low cohesion: SsoConfigurationData (LCOM4 7) src/Core/Auth/Models/Data/SsoConfigurationData.cs:10
- Low cohesion: MaskedPaymentMethod (LCOM4 7) src/Core/Billing/Payment/Models/MaskedPaymentMethod.cs:31
- Low cohesion: NoopSendFileStorageService (LCOM4 7) src/Core/Tools/Services/NoopImplementations/NoopSendFileStorageService.cs:9
- Low cohesion: ResourceOwnerPasswordValidator (LCOM4 7) src/Identity/IdentityServer/RequestValidators/ResourceOwnerPasswordValidator.cs:21
- Low cohesion: WebAuthnGrantValidator (LCOM4 7) src/Identity/IdentityServer/RequestValidators/WebAuthnGrantValidator.cs:24
- Low cohesion: NoopOrganizationReportStorageService (LCOM4 6) src/Core/Dirt/Reports/Services/NoopOrganizationReportStorageService.cs:7
- Low cohesion: CustomTokenRequestValidator (LCOM4 6) src/Identity/IdentityServer/RequestValidators/CustomTokenRequestValidator.cs:23
- Low cohesion: AuthRequestRepository (LCOM4 6) src/Infrastructure.Dapper/Auth/Repositories/AuthRequestRepository.cs:15
- Low cohesion: AuthRequestRepository (LCOM4 6) src/Infrastructure.EntityFramework/Auth/Repositories/AuthRequestRepository.cs:16
- Low cohesion: SendRepository (LCOM4 6) src/Infrastructure.EntityFramework/Tools/Repositories/SendRepository.cs:19
D12 · Dependency Hygiene
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: Rnwood.SmtpServer
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
- Deprecated: xunit
D3 · God Classes
- TooManyMethods: HostBuilderExtensions root/.nuget/packages/bitwarden.server.sdk/1.5.2/Content/HostBuilderExtensions.cs:0
- TooManyMethods: OrganizationUsersController src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:0
- TooManyMethods: AccountsController src/Api/Auth/Controllers/AccountsController.cs:0
- TooManyMethods: TwoFactorController src/Api/Auth/Controllers/TwoFactorController.cs:0
- TooManyMethods: CiphersController src/Api/Vault/Controllers/CiphersController.cs:0
- TooManyMethods: StripeAdapter src/Core/Billing/Services/Implementations/StripeAdapter.cs:0
- TooManyMethods: CurrentContext src/Core/Context/CurrentContext.cs:0
- TooManyMethods: EventService src/Core/Dirt/Services/Implementations/EventService.cs:0
- TooManyMethods: HandlebarsMailService src/Core/Platform/Mail/HandlebarsMailService.cs:0
- TooManyMethods: NoopMailService src/Core/Platform/Mail/NoopMailService.cs:0
- TooManyMethods: UserService src/Core/Services/Implementations/UserService.cs:0
- TooManyMethods: CoreHelpers src/Core/Utilities/CoreHelpers.cs:0
- TooManyMethods: CipherService src/Core/Vault/Services/Implementations/CipherService.cs:0
- TooManyMethods: OrganizationUserRepository src/Infrastructure.Dapper/AdminConsole/Repositories/OrganizationUserRepository.cs:0
- TooManyMethods: UserRepository src/Infrastructure.Dapper/Repositories/UserRepository.cs:0
- TooManyMethods: CipherRepository src/Infrastructure.Dapper/Vault/Repositories/CipherRepository.cs:0
- TooManyMethods: OrganizationUserRepository src/Infrastructure.EntityFramework/AdminConsole/Repositories/OrganizationUserRepository.cs:0
- TooManyMethods: CipherRepository src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs:0
- TooManyMethods: SecretRepository bitwarden_license/src/Commercial.Infrastructure.EntityFramework/SecretsManager/Repositories/SecretRepository.cs:0
D3 · God Classes
- FileTooLong: Controllers/OrganizationsController.cs src/Admin/AdminConsole/Controllers/OrganizationsController.cs:0
- FileTooLong: Controllers/OrganizationUsersController.cs src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:0
- FileTooLong: Controllers/CiphersController.cs src/Api/Vault/Controllers/CiphersController.cs:0
- FileTooLong: Implementations/UpcomingInvoiceHandler.cs src/Billing/Services/Implementations/UpcomingInvoiceHandler.cs:0
- FileTooLong: Implementations/OrganizationService.cs src/Core/AdminConsole/Services/Implementations/OrganizationService.cs:0
- FileTooLong: Implementations/StripePaymentService.cs src/Core/Billing/Services/Implementations/StripePaymentService.cs:0
- FileTooLong: Implementations/TaxService.cs src/Core/Billing/Tax/Services/Implementations/TaxService.cs:0
- FileTooLong: Mail/HandlebarsMailService.cs src/Core/Platform/Mail/HandlebarsMailService.cs:0
- FileTooLong: Implementations/UserService.cs src/Core/Services/Implementations/UserService.cs:0
- FileTooLong: Implementations/CipherService.cs src/Core/Vault/Services/Implementations/CipherService.cs:0
- FileTooLong: Repositories/CipherRepository.cs src/Infrastructure.Dapper/Vault/Repositories/CipherRepository.cs:0
- FileTooLong: Repositories/CollectionRepository.cs src/Infrastructure.EntityFramework/AdminConsole/Repositories/CollectionRepository.cs:0
- FileTooLong: Repositories/OrganizationUserRepository.cs src/Infrastructure.EntityFramework/AdminConsole/Repositories/OrganizationUserRepository.cs:0
- FileTooLong: Repositories/CipherRepository.cs src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs:0
- FileTooLong: Utilities/ServiceCollectionExtensions.cs src/SharedWeb/Utilities/ServiceCollectionExtensions.cs:0
- FileTooLong: Services/ProviderBillingService.cs bitwarden_license/src/Commercial.Core/Billing/Providers/Services/ProviderBillingService.cs:0
D38 · OSV Dependency Vulnerabilities
- Medium CVE: [GHSA redacted] bitwarden_license/src/Sso/package-lock.json
- Medium CVE: [GHSA redacted] bitwarden_license/src/Sso/package-lock.json
- Medium CVE: [GHSA redacted] bitwarden_license/src/Sso/package-lock.json
- Medium CVE: [GHSA redacted] src/Admin/package-lock.json
- Medium CVE: [GHSA redacted] src/Admin/package-lock.json
- Medium CVE: [GHSA redacted] src/Admin/package-lock.json
- Medium CVE: [GHSA redacted] src/Admin/package-lock.json
- Medium CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- Medium CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- Medium CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- Medium CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- Medium CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- Medium CVE: [GHSA redacted] src/Core/MailTemplates/Mjml/package-lock.json
- Medium CVE: RUSTSEC-2026-0097 util/RustSdk/rust/Cargo.lock
- Medium CVE: RUSTSEC-2023-0071 util/RustSdk/rust/Cargo.lock
D3 · God Classes
- ClassTooLong: OrganizationsController src/Admin/AdminConsole/Controllers/OrganizationsController.cs:0
- ClassTooLong: SubscriptionUpdatedHandler src/Billing/Services/Implementations/SubscriptionUpdatedHandler.cs:0
- ClassTooLong: UpcomingInvoiceHandler src/Billing/Services/Implementations/UpcomingInvoiceHandler.cs:0
- ClassTooLong: OrganizationService src/Core/AdminConsole/Services/Implementations/OrganizationService.cs:0
- ClassTooLong: StripePaymentService src/Core/Billing/Services/Implementations/StripePaymentService.cs:0
- ClassTooLong: TaxService src/Core/Billing/Tax/Services/Implementations/TaxService.cs:0
- ClassTooLong: GlobalSettings src/Core/Settings/GlobalSettings.cs:0
- ClassTooLong: CollectionRepository src/Infrastructure.EntityFramework/AdminConsole/Repositories/CollectionRepository.cs:0
- ClassTooLong: ServiceCollectionExtensions src/SharedWeb/Utilities/ServiceCollectionExtensions.cs:0
- ClassTooLong: ProviderService bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs:0
- ClassTooLong: ProviderBillingService bitwarden_license/src/Commercial.Core/Billing/Providers/Services/ProviderBillingService.cs:0
- ClassTooLong: AccessPolicyRepository bitwarden_license/src/Commercial.Infrastructure.EntityFramework/SecretsManager/Repositories/AccessPolicyRepository.cs:0
- ClassTooLong: AccountController bitwarden_license/src/Sso/Controllers/AccountController.cs:0
D5 · Coupling
- Off the main sequence: AppHost
- Off the main sequence: RustSdk
- Off the main sequence: Server
- Off the main sequence: Infrastructure.EntityFramework
- Off the main sequence: Infrastructure.Dapper
- Off the main sequence: Migrator
- Off the main sequence: SharedWeb
- Off the main sequence: Commercial.Core
- Off the main sequence: Core
- Off the main sequence: Commercial.Infrastructure.EntityFramework
D4 · Code Duplication
- Duplicated block (11 lines × 2) src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/AutoConfirmUser/AutomaticallyConfirmOrganizationUserCommand.cs:151
- Duplicated block (11 lines × 2) src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyEventHandlers/SingleOrgPolicyEventHandler.cs:98
- Duplicated block (11 lines × 2) src/Core/Auth/Entities/Grant.cs:13
- Duplicated block (11 lines × 2) src/Core/Billing/Models/Business/UserLicense.cs:104
- Duplicated block (11 lines × 2) src/Core/Dirt/Entities/Event.cs:26
- Duplicated block (11 lines × 2) src/Identity/Startup.cs:80
- Duplicated block (11 lines × 2) src/Infrastructure.Dapper/AdminConsole/Repositories/GroupRepository.cs:145
- Duplicated block (11 lines × 2) src/Infrastructure.Dapper/Tools/Repositories/SendRepository.cs:53
- Duplicated block (11 lines × 2) src/Infrastructure.Dapper/Tools/Repositories/SendRepository.cs:67
D4 · Code Duplication
- Duplicated block (8 lines × 2) src/Core/AdminConsole/OrganizationFeatures/Policies/PolicyEventHandlers/SingleOrgPolicyEventHandler.cs:76
- Duplicated block (8 lines × 2) src/Core/Vault/Services/Implementations/CipherService.cs:446
- Duplicated block (8 lines × 2) src/Infrastructure.Dapper/DapperServiceCollectionExtensions.cs:68
- Duplicated block (8 lines × 2) src/Infrastructure.EntityFramework/Repositories/BaseEntityFrameworkRepository.cs:61
- Duplicated block (8 lines × 2) src/Infrastructure.EntityFramework/Repositories/DatabaseContext.cs:125
- Duplicated block (8 lines × 2) util/Seeder/Data/Generators/SecureNoteDataGenerator.cs:120
D33 · JS/npm Dependency Vulnerabilities
- Medium CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- Medium CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- Medium CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- Medium CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
- Medium CVE: [CVE redacted] src/Core/MailTemplates/Mjml/package-lock.json
D4 · Code Duplication
- Duplicated block (13 lines × 2) src/Core/AdminConsole/OrganizationFeatures/Groups/CreateGroupCommand.cs:85
- Duplicated block (13 lines × 2) src/Core/Auth/UserFeatures/Registration/Implementations/RegisterUserCommand.cs:310
- Duplicated block (13 lines × 2) src/Infrastructure.EntityFramework/Repositories/TransactionRepository.cs:36
- Duplicated block (13 lines × 2) bitwarden_license/src/Scim/Groups/PostGroupCommand.cs:46
D4 · Code Duplication
- Duplicated block (12 lines × 2) src/Admin/AdminConsole/Controllers/OrganizationsController.cs:180
- Duplicated block (12 lines × 2) src/Api/SecretsManager/Controllers/SecretsController.cs:346
- Duplicated block (12 lines × 2) src/Core/Vault/Models/Data/CipherDetails.cs:72
- Duplicated block (12 lines × 2) util/Seeder/Steps/CreateCollectionsStep.cs:153
D4 · Code Duplication
- Duplicated block (9 lines × 2) src/Api/Utilities/ExceptionHandlerFilterAttribute.cs:167
- Duplicated block (9 lines × 2) src/Core/Platform/Mail/HandlebarsMailService.cs:993
- Duplicated block (9 lines × 2) src/Icons/Models/DomainIcons.cs:79
- Duplicated block (9 lines × 2) src/Infrastructure.EntityFramework/Dirt/Repositories/EventRepository.cs:159
D4 · Code Duplication
- Duplicated block (7 lines × 2) src/Core/Dirt/EventIntegrations/EventIntegrationsServiceCollectionExtensions.cs:396
- Duplicated block (7 lines × 2) src/Core/NotificationCenter/Authorization/NotificationAuthorizationHandler.cs:50
- Duplicated block (7 lines × 2) src/Infrastructure.Dapper/DapperServiceCollectionExtensions.cs:35
- Duplicated block (7 lines × 2) bitwarden_license/src/Commercial.Infrastructure.EntityFramework/SecretsManager/Repositories/ServiceAccountRepository.cs:28
D17 · Explicit Debt
- CommentedOutCode src/Api/Dirt/Controllers/OrganizationReportsController.cs:476
- CommentedOutCode src/Api/Tools/Controllers/SendsController.cs:84
- CommentedOutCode src/Api/Tools/Controllers/SendsController.cs:148
D4 · Code Duplication
- Duplicated block (20 lines × 2) src/Api/Vault/Controllers/CiphersController.cs:563
- Duplicated block (20 lines × 2) src/Infrastructure.Dapper/AdminConsole/Repositories/CollectionRepository.cs:184
- Duplicated block (20 lines × 2) src/Infrastructure.Dapper/AdminConsole/Repositories/OrganizationUserRepository.cs:249
D4 · Code Duplication
- Duplicated block (16 lines × 2) src/Core/Vault/Commands/ArchiveCiphersCommand.cs:25
- Duplicated block (16 lines × 2) src/Infrastructure.Dapper/Tools/Repositories/SendRepository.cs:263
- Duplicated block (16 lines × 2) bitwarden_license/src/Commercial.Infrastructure.EntityFramework/SecretsManager/Repositories/SecretRepository.cs:225
D4 · Code Duplication
- Duplicated block (15 lines × 2) src/Api/Tools/Models/Response/SendAccessResponseModel.cs:35
- Duplicated block (15 lines × 2) src/Api/Utilities/ExceptionHandlerFilterAttribute.cs:113
- Duplicated block (15 lines × 2) src/Infrastructure.Dapper/Dirt/OrganizationReportRepository.cs:63
D4 · Code Duplication
- Duplicated block (9 lines × 3) src/Infrastructure.EntityFramework/Dirt/Repositories/EventRepository.cs:70
- Duplicated block (9 lines × 3) src/Infrastructure.EntityFramework/Dirt/Repositories/EventRepository.cs:184
- Duplicated block (9 lines × 3) src/Infrastructure.EntityFramework/Dirt/Repositories/EventRepository.cs:195
D10 · Test Quality
- Skipped test: GetIconAsync_Success test/Icons.Test/Services/IconFetchingServiceTests.cs:8
- Skipped test: RefreshDb test/Infrastructure.EFIntegration.Test/Vault/Repositories/CipherRepositoryTests.cs:25
D17 · Explicit Debt
- BarePragmaDisable src/Api/Auth/Controllers/AccountsController.cs:672
- BarePragmaDisable src/Core/Auth/UserFeatures/EmergencyAccess/Mail/EmergencyAccessRemoveGranteesMailView.cs:10
D17 · Explicit Debt
- HackComment src/Core/Billing/Services/Implementations/StripePaymentService.cs:482
- HackComment bitwarden_license/src/Sso/Controllers/AccountController.cs:373
D4 · Code Duplication
- Duplicated block (22 lines × 2) src/Core/Dirt/Services/Implementations/EventService.cs:489
- Duplicated block (22 lines × 2) src/Core/Dirt/Services/Implementations/EventService.cs:543
D4 · Code Duplication
- Duplicated block (21 lines × 2) src/Core/Billing/Licenses/Extensions/LicenseExtensions.cs:16
- Duplicated block (21 lines × 2) src/Core/Billing/Organizations/PlanMigration/Commands/RedeemChurnMitigationOfferCommand.cs:107
D4 · Code Duplication
- Duplicated block (17 lines × 2) src/Core/OrganizationFeatures/OrganizationSponsorships/FamiliesForEnterprise/Cloud/ValidateSponsorshipCommand.cs:51
- Duplicated block (17 lines × 2) src/Infrastructure.EntityFramework/Dirt/Repositories/OrganizationReportRepository.cs:72
D4 · Code Duplication
- Duplicated block (14 lines × 2) src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/OrganizationUserUserDetailsQuery.cs:75
- Duplicated block (14 lines × 2) src/Identity/Controllers/SsoController.cs:256
D4 · Code Duplication
- Duplicated block (10 lines × 3) src/Infrastructure.Dapper/Vault/Repositories/CipherRepository.cs:244
- Duplicated block (10 lines × 3) util/Seeder/Steps/CreateCipherCollectionsStep.cs:19
D1 · Cyclomatic Complexity
- CollectController.Post (cyclomatic 55) src/Events/Controllers/CollectController.cs:41
D1 · Cyclomatic Complexity
- OrganizationLicense.GetDataBytes (cyclomatic 54) src/Core/Billing/Organizations/Models/OrganizationLicense.cs:182
D1 · Cyclomatic Complexity
- HubHelpers.SendNotificationToHubAsync (cyclomatic 50) src/Notifications/HubHelpers.cs:28
D1 · Cyclomatic Complexity
- UpgradeOrganizationPlanCommand.UpgradePlanAsync (cyclomatic 49) src/Core/OrganizationFeatures/OrganizationSubscriptions/UpgradeOrganizationPlanCommand.cs:85
D1 · Cyclomatic Complexity
- OrganizationLicense.ObsoleteVerifyData (cyclomatic 42) src/Core/Billing/Organizations/Models/OrganizationLicense.cs:503
D1 · Cyclomatic Complexity
- OrganizationLicense.VerifyData (cyclomatic 39) src/Core/Billing/Organizations/Models/OrganizationLicense.cs:400
D1 · Cyclomatic Complexity
- RegisterFinishRequestModel.Validate (cyclomatic 37) src/Core/Auth/Models/Api/Request/Accounts/RegisterFinishRequestModel.cs:167
D1 · Cyclomatic Complexity
- OrganizationsController.Edit (cyclomatic 34) src/Admin/AdminConsole/Controllers/OrganizationsController.cs:293
D1 · Cyclomatic Complexity
- HandlebarsMailService.RegisterHelpersAndPartialsAsync (cyclomatic 31) src/Core/Platform/Mail/HandlebarsMailService.cs:987
D1 · Cyclomatic Complexity
- SelfHostedOrganizationDetails.CanUseLicense (cyclomatic 29) src/Core/AdminConsole/Models/Data/Organizations/SelfHostedOrganizationDetails.cs:25
D1 · Cyclomatic Complexity
- PayPalController.PostIpn (cyclomatic 28) src/Billing/Controllers/PayPalController.cs:54
D1 · Cyclomatic Complexity
- OrganizationService.ValidateCustomPermissionsGrant (cyclomatic 28) src/Core/AdminConsole/Services/Implementations/OrganizationService.cs:1001
D1 · Cyclomatic Complexity
- PresetLoader.BuildRecipe (cyclomatic 28) util/Seeder/Pipeline/PresetLoader.cs:92
D1 · Cyclomatic Complexity
- OrganizationService.SaveUsersSendInvitesAsync (cyclomatic 27) src/Core/AdminConsole/Services/Implementations/OrganizationService.cs:506
D1 · Cyclomatic Complexity
- SecretRepository.BuildSecretAccessQuery (cyclomatic 25) bitwarden_license/src/Commercial.Infrastructure.EntityFramework/SecretsManager/Repositories/SecretRepository.cs:476
D1 · Cyclomatic Complexity
- ExceptionHandlerFilterAttribute.OnException (cyclomatic 24) src/Api/Utilities/ExceptionHandlerFilterAttribute.cs:25
D1 · Cyclomatic Complexity
- PlanAdapter.ToPlanType (cyclomatic 24) src/Core/Billing/Pricing/Organizations/PlanAdapter.cs:51
D1 · Cyclomatic Complexity
- PricingClient.GetLookupKey (cyclomatic 24) src/Core/Billing/Pricing/PricingClient.cs:110
D1 · Cyclomatic Complexity
- PolicyTypeExtensions.GetName (cyclomatic 23) src/Core/AdminConsole/Enums/PolicyType.cs:42
D1 · Cyclomatic Complexity
- UpdateOrganizationSubscriptionCommand.Run (cyclomatic 23) src/Core/Billing/Organizations/Commands/UpdateOrganizationSubscriptionCommand.cs:68
D1 · Cyclomatic Complexity
- CoreHelpers.BuildIdentityClaims (cyclomatic 23) src/Core/Utilities/CoreHelpers.cs:716
D1 · Cyclomatic Complexity
- Context.LoadConfiguration (cyclomatic 23) util/Setup/Context.cs:67
D1 · Cyclomatic Complexity
- ProvidersController.Edit (cyclomatic 22) src/Admin/AdminConsole/Controllers/ProvidersController.cs:273
D1 · Cyclomatic Complexity
- OrganizationService.AdjustSeatsAsync (cyclomatic 22) src/Core/AdminConsole/Services/Implementations/OrganizationService.cs:221
D1 · Cyclomatic Complexity
- StripePaymentService.FinalizeSubscriptionChangeAsync (cyclomatic 22) src/Core/Billing/Services/Implementations/StripePaymentService.cs:90
D1 · Cyclomatic Complexity
- PatchGroupCommand.HandleOperationAsync (cyclomatic 22) bitwarden_license/src/Scim/Groups/PatchGroupCommand.cs:51
D1 · Cyclomatic Complexity
- SubscriptionUpdatedHandler.HandleScheduleTriggeredBusinessMigrationAsync (cyclomatic 21) src/Billing/Services/Implementations/SubscriptionUpdatedHandler.cs:540
D1 · Cyclomatic Complexity
- AdminRecoverAccountValidator.ValidateAsync (cyclomatic 21) src/Core/AdminConsole/OrganizationFeatures/AccountRecovery/v2/AdminRecoverAccountValidator.cs:15
D1 · Cyclomatic Complexity
- OrganizationBillingService.CreateCustomerAsync (cyclomatic 21) src/Core/Billing/Organizations/Services/OrganizationBillingService.cs:190
D1 · Cyclomatic Complexity
- UpdatePremiumStorageCommand.Run (cyclomatic 21) src/Core/Billing/Premium/Commands/UpdatePremiumStorageCommand.cs:45
D1 · Cyclomatic Complexity
- StripePaymentService.PayInvoiceAfterSubscriptionChangeAsync (cyclomatic 21) src/Core/Billing/Services/Implementations/StripePaymentService.cs:353
D1 · Cyclomatic Complexity
- IntegrationHandlerBase.ClassifyHttpStatusCode (cyclomatic 21) src/Core/Dirt/Services/IIntegrationHandler.cs:81
D1 · Cyclomatic Complexity
- CipherRequestModel.ToCipher (cyclomatic 20) src/Api/Vault/Models/Request/CipherRequestModel.cs:94
D1 · Cyclomatic Complexity
- StripeEventUtilityService.FromChargeToTransactionAsync (cyclomatic 20) src/Billing/Services/Implementations/StripeEventUtilityService.cs:127
D1 · Cyclomatic Complexity
- GenerateCiphersStep.Execute (cyclomatic 20) util/Seeder/Steps/GenerateCiphersStep.cs:35
D1 · Cyclomatic Complexity
- BitPayController.PostIpn (cyclomatic 19) src/Billing/Controllers/BitPayController.cs:37
D1 · Cyclomatic Complexity
- RemoveOrganizationUserCommand.RemoveUsersInternalAsync (cyclomatic 19) src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RemoveOrganizationUserCommand.cs:198
D1 · Cyclomatic Complexity
- UpcomingInvoiceHandler.ResolveDiscountsAsync (cyclomatic 18) src/Billing/Services/Implementations/UpcomingInvoiceHandler.cs:527
D1 · Cyclomatic Complexity
- UpdateOrganizationUserCommand.UpdateUserAsync (cyclomatic 18) src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserCommand.cs:66
D1 · Cyclomatic Complexity
- PreviewOrganizationTaxCommand.Run (cyclomatic 18) src/Core/Billing/Organizations/Commands/PreviewOrganizationTaxCommand.cs:163
D1 · Cyclomatic Complexity
- ProviderPriceAdapter.GetPriceId (cyclomatic 18) src/Core/Billing/Providers/Services/ProviderPriceAdapter.cs:54
D1 · Cyclomatic Complexity
- EventRepository.BuildEventsTable (cyclomatic 18) src/Infrastructure.Dapper/Dirt/Repositories/EventRepository.cs:191
D1 · Cyclomatic Complexity
- AccountController.CreateUserAndOrgUserConditionallyAsync (cyclomatic 18) bitwarden_license/src/Sso/Controllers/AccountController.cs:487
D1 · Cyclomatic Complexity
- CreateRosterStep.Execute (cyclomatic 18) util/Seeder/Steps/CreateRosterStep.cs:14
D1 · Cyclomatic Complexity
- PaymentMethodAttachedHandler.HandleAsync (cyclomatic 17) src/Billing/Services/Implementations/PaymentMethodAttachedHandler.cs:35
D1 · Cyclomatic Complexity
- RestoreOrganizationUserCommand.RestoreUsersAsync (cyclomatic 17) src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RestoreUser/v1/RestoreOrganizationUserCommand.cs:173
D1 · Cyclomatic Complexity
- CreateSponsorshipCommand.CreateSponsorshipAsync (cyclomatic 17) src/Core/OrganizationFeatures/OrganizationSponsorships/FamiliesForEnterprise/CreateSponsorshipCommand.cs:21
D1 · Cyclomatic Complexity
- UserService.AdminResetPasswordAsync (cyclomatic 17) src/Core/Services/Implementations/UserService.cs:577
D1 · Cyclomatic Complexity
- ImportCiphersCommand.ImportIntoOrganizationalVaultAsync (cyclomatic 17) src/Core/Tools/ImportFeatures/ImportCiphersCommand.cs:87
D1 · Cyclomatic Complexity
- SendValidationService.ValidateUserCanSaveAsync (cyclomatic 17) src/Core/Tools/SendFeatures/Services/SendValidationService.cs:41
D1 · Cyclomatic Complexity
- Saml2OptionsExtensions.CouldHandleAsync (cyclomatic 17) bitwarden_license/src/Sso/Utilities/Saml2OptionsExtensions.cs:14
D1 · Cyclomatic Complexity
- SsoAuthenticationMiddleware.Invoke (cyclomatic 17) bitwarden_license/src/Sso/Utilities/SsoAuthenticationMiddleware.cs:20
D1 · Cyclomatic Complexity
- SecureNoteDataGenerator.GenerateNoteName (cyclomatic 17) util/Seeder/Data/Generators/SecureNoteDataGenerator.cs:43
D1 · Cyclomatic Complexity
- SecureNoteDataGenerator.GenerateNoteContent (cyclomatic 17) util/Seeder/Data/Generators/SecureNoteDataGenerator.cs:63
D1 · Cyclomatic Complexity
- Program.ValidateInstallation (cyclomatic 17) util/Setup/Program.cs:287
D1 · Cyclomatic Complexity
- OrganizationsController.HandlePotentialProviderSeatScalingAsync (cyclomatic 16) src/Admin/AdminConsole/Controllers/OrganizationsController.cs:782
D1 · Cyclomatic Complexity
- BulkCollectionAuthorizationHandler.HandleRequirementAsync (cyclomatic 16) src/Api/AdminConsole/Authorization/Collections/BulkCollectionAuthorizationHandler.cs:42
D1 · Cyclomatic Complexity
- UpdateTwoFactorYubicoOtpRequestModel.Validate (cyclomatic 16) src/Api/Auth/Models/Request/TwoFactorRequestModels.cs:183
D1 · Cyclomatic Complexity
- PaymentSucceededHandler.HandleAsync (cyclomatic 16) src/Billing/Services/Implementations/PaymentSucceededHandler.cs:32
D1 · Cyclomatic Complexity
- LicenseExtensions.GetValue (cyclomatic 16) src/Core/Billing/Licenses/Extensions/LicenseExtensions.cs:114
D1 · Cyclomatic Complexity
- LicensingService.LicensingService.ctor (cyclomatic 16) src/Core/Billing/Services/Implementations/LicensingService.cs:49
D1 · Cyclomatic Complexity
- RestartSubscriptionCommand.RestartOrganizationSubscriptionAsync (cyclomatic 16) src/Core/Billing/Subscriptions/Commands/RestartSubscriptionCommand.cs:54
D1 · Cyclomatic Complexity
- SlackIntegrationHandler.ClassifySlackError (cyclomatic 16) src/Core/Dirt/Services/Implementations/SlackIntegrationHandler.cs:55
D1 · Cyclomatic Complexity
- ValidateSponsorshipCommand.ValidateSponsorshipAsync (cyclomatic 16) src/Core/OrganizationFeatures/OrganizationSponsorships/FamiliesForEnterprise/Cloud/ValidateSponsorshipCommand.cs:34
D1 · Cyclomatic Complexity
- UserDecryptionOptionsBuilder.BuildTrustedDeviceOptionsAsync (cyclomatic 16) src/Identity/IdentityServer/UserDecryptionOptionsBuilder.cs:102
D1 · Cyclomatic Complexity
- ServiceCollectionExtensions.AddDefaultServices (cyclomatic 16) src/SharedWeb/Utilities/ServiceCollectionExtensions.cs:264
D1 · Cyclomatic Complexity
- CreateCiphersStep.Execute (cyclomatic 16) util/Seeder/Steps/CreateCiphersStep.cs:34
D15 · Churn × Complexity Hotspots
- git history depth insufficient
D16 · Bus Factor
- single-maintainer — knowledge-concentration (bus factor) risk
D19 · Documentation Quality
- LLM evaluation failed
D2 · Cognitive Complexity
- UpgradeOrganizationPlanCommand.UpgradePlanAsync (cognitive 63) src/Core/OrganizationFeatures/OrganizationSubscriptions/UpgradeOrganizationPlanCommand.cs:85
D2 · Cognitive Complexity
- Context.LoadConfiguration (cognitive 61) util/Setup/Context.cs:67
D2 · Cognitive Complexity
- CoreHelpers.BuildIdentityClaims (cognitive 57) src/Core/Utilities/CoreHelpers.cs:716
D2 · Cognitive Complexity
- CollectController.Post (cognitive 54) src/Events/Controllers/CollectController.cs:41
D2 · Cognitive Complexity
- RegisterFinishRequestModel.Validate (cognitive 46) src/Core/Auth/Models/Api/Request/Accounts/RegisterFinishRequestModel.cs:167
D2 · Cognitive Complexity
- OrganizationsController.Edit (cognitive 45) src/Admin/AdminConsole/Controllers/OrganizationsController.cs:293
D2 · Cognitive Complexity
- HandlebarsMailService.RegisterHelpersAndPartialsAsync (cognitive 43) src/Core/Platform/Mail/HandlebarsMailService.cs:987
D2 · Cognitive Complexity
- GenerateCiphersStep.Execute (cognitive 43) util/Seeder/Steps/GenerateCiphersStep.cs:35
D2 · Cognitive Complexity
- OrganizationService.SaveUsersSendInvitesAsync (cognitive 42) src/Core/AdminConsole/Services/Implementations/OrganizationService.cs:506
D2 · Cognitive Complexity
- HubHelpers.SendNotificationToHubAsync (cognitive 41) src/Notifications/HubHelpers.cs:28
D2 · Cognitive Complexity
- ExceptionHandlerFilterAttribute.OnException (cognitive 40) src/Api/Utilities/ExceptionHandlerFilterAttribute.cs:25
D2 · Cognitive Complexity
- StripePaymentService.PayInvoiceAfterSubscriptionChangeAsync (cognitive 39) src/Core/Billing/Services/Implementations/StripePaymentService.cs:353
D2 · Cognitive Complexity
- PatchUserCommand.PatchUserAsync (cognitive 37) bitwarden_license/src/Scim/Users/PatchUserCommand.cs:30
D2 · Cognitive Complexity
- CipherRepository.ReplaceAsync (cognitive 36) src/Infrastructure.EntityFramework/Vault/Repositories/CipherRepository.cs:562
D2 · Cognitive Complexity
- CreateRosterStep.Execute (cognitive 36) util/Seeder/Steps/CreateRosterStep.cs:14
D2 · Cognitive Complexity
- PayPalController.PostIpn (cognitive 33) src/Billing/Controllers/PayPalController.cs:54
D2 · Cognitive Complexity
- OrganizationBillingService.CreateCustomerAsync (cognitive 32) src/Core/Billing/Organizations/Services/OrganizationBillingService.cs:190
D2 · Cognitive Complexity
- UpdatePremiumStorageCommand.Run (cognitive 32) src/Core/Billing/Premium/Commands/UpdatePremiumStorageCommand.cs:45
D2 · Cognitive Complexity
- BaseJobsHostedService.StartAsync (cognitive 31) src/Core/Jobs/BaseJobsHostedService.cs:36
D2 · Cognitive Complexity
- EventRepository.BuildEventsTable (cognitive 31) src/Infrastructure.Dapper/Dirt/Repositories/EventRepository.cs:191
D2 · Cognitive Complexity
- SsoConfigurationDataRequest.Validate (cognitive 30) src/Api/Auth/Models/Request/OrganizationSsoRequestModel.cs:92
D2 · Cognitive Complexity
- PreviewOrganizationTaxCommand.Run (cognitive 30) src/Core/Billing/Organizations/Commands/PreviewOrganizationTaxCommand.cs:163
D2 · Cognitive Complexity
- CheckDuplicateOperationIdsDocumentFilter.Apply (cognitive 30) src/SharedWeb/Swagger/CheckDuplicateOperationIdsDocumentFilter.cs:16
D2 · Cognitive Complexity
- AccountController.CreateUserAndOrgUserConditionallyAsync (cognitive 30) bitwarden_license/src/Sso/Controllers/AccountController.cs:487
D2 · Cognitive Complexity
- OrganizationLicense.ObsoleteVerifyData (cognitive 29) src/Core/Billing/Organizations/Models/OrganizationLicense.cs:503
D2 · Cognitive Complexity
- UpdateBillingAddressCommand.EnableAutomaticTaxAsync (cognitive 29) src/Core/Billing/Payment/Commands/UpdateBillingAddressCommand.cs:133
D2 · Cognitive Complexity
- ProvidersController.Edit (cognitive 28) src/Admin/AdminConsole/Controllers/ProvidersController.cs:273
D2 · Cognitive Complexity
- StripePaymentService.FinalizeSubscriptionChangeAsync (cognitive 28) src/Core/Billing/Services/Implementations/StripePaymentService.cs:90
D2 · Cognitive Complexity
- OrganizationService.AdjustSeatsAsync (cognitive 27) src/Core/AdminConsole/Services/Implementations/OrganizationService.cs:221
D2 · Cognitive Complexity
- OrganizationService.ValidateCustomPermissionsGrant (cognitive 27) src/Core/AdminConsole/Services/Implementations/OrganizationService.cs:1001
D2 · Cognitive Complexity
- CipherService.ShareAsync (cognitive 27) src/Core/Vault/Services/Implementations/CipherService.cs:568
D2 · Cognitive Complexity
- SubscriberService.RemovePaymentSource (cognitive 26) src/Core/Billing/Services/Implementations/SubscriberService.cs:463
D2 · Cognitive Complexity
- UpdateSecretsManagerSubscriptionCommand.FinalizeSubscriptionAdjustmentAsync (cognitive 26) src/Core/OrganizationFeatures/OrganizationSubscriptions/UpdateSecretsManagerSubscriptionCommand.cs:76
D2 · Cognitive Complexity
- SsoAuthenticationMiddleware.Invoke (cognitive 26) bitwarden_license/src/Sso/Utilities/SsoAuthenticationMiddleware.cs:20
D2 · Cognitive Complexity
- Program.ValidateInstallation (cognitive 26) util/Setup/Program.cs:287
D2 · Cognitive Complexity
- UpdateOrganizationSubscriptionCommand.Run (cognitive 25) src/Core/Billing/Organizations/Commands/UpdateOrganizationSubscriptionCommand.cs:68
D2 · Cognitive Complexity
- CollectionRepository.CreateOrUpdateAccessForManyAsync (cognitive 25) src/Infrastructure.EntityFramework/AdminConsole/Repositories/CollectionRepository.cs:652
D2 · Cognitive Complexity
- PresetLoader.BuildRecipe (cognitive 25) util/Seeder/Pipeline/PresetLoader.cs:92
D2 · Cognitive Complexity
- BitPayController.PostIpn (cognitive 24) src/Billing/Controllers/BitPayController.cs:37
D2 · Cognitive Complexity
- StripePaymentService.ApplySchedulePhase2DataAsync (cognitive 24) src/Core/Billing/Services/Implementations/StripePaymentService.cs:714
D2 · Cognitive Complexity
- AzureQueueHostedService.ExecuteAsync (cognitive 24) src/Notifications/AzureQueueHostedService.cs:50
D2 · Cognitive Complexity
- PaymentMethodAttachedHandler.HandleAsync (cognitive 23) src/Billing/Services/Implementations/PaymentMethodAttachedHandler.cs:35
D2 · Cognitive Complexity
- RemoveOrganizationUserCommand.RemoveUsersInternalAsync (cognitive 23) src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RemoveOrganizationUserCommand.cs:198
D2 · Cognitive Complexity
- OrganizationLicense.GetDataBytes (cognitive 23) src/Core/Billing/Organizations/Models/OrganizationLicense.cs:182
D2 · Cognitive Complexity
- CreateSponsorshipCommand.CreateSponsorshipAsync (cognitive 23) src/Core/OrganizationFeatures/OrganizationSponsorships/FamiliesForEnterprise/CreateSponsorshipCommand.cs:21
D2 · Cognitive Complexity
- UserService.DeleteAsync (cognitive 23) src/Core/Services/Implementations/UserService.cs:224
D2 · Cognitive Complexity
- LicenseExtensions.GetValue (cognitive 22) src/Core/Billing/Licenses/Extensions/LicenseExtensions.cs:114
D2 · Cognitive Complexity
- PaymentSucceededHandler.HandleAsync (cognitive 21) src/Billing/Services/Implementations/PaymentSucceededHandler.cs:32
D2 · Cognitive Complexity
- SubscriptionUpdatedHandler.HandleScheduleTriggeredBusinessMigrationAsync (cognitive 21) src/Billing/Services/Implementations/SubscriptionUpdatedHandler.cs:540
D2 · Cognitive Complexity
- UpcomingInvoiceHandler.ResolveDiscountsAsync (cognitive 21) src/Billing/Services/Implementations/UpcomingInvoiceHandler.cs:527
D2 · Cognitive Complexity
- RestoreOrganizationUserCommand.RestoreUsersAsync (cognitive 21) src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RestoreUser/v1/RestoreOrganizationUserCommand.cs:173
D2 · Cognitive Complexity
- CloudSyncSponsorshipsCommand.DoSyncAsync (cognitive 21) src/Core/OrganizationFeatures/OrganizationSponsorships/FamiliesForEnterprise/Cloud/CloudSyncSponsorshipsCommand.cs:46
D2 · Cognitive Complexity
- ImportCiphersCommand.ImportIntoOrganizationalVaultAsync (cognitive 21) src/Core/Tools/ImportFeatures/ImportCiphersCommand.cs:87
D2 · Cognitive Complexity
- OrganizationUserRepository.DeleteManyAsync (cognitive 21) src/Infrastructure.EntityFramework/AdminConsole/Repositories/OrganizationUserRepository.cs:174
D2 · Cognitive Complexity
- ServiceCollectionExtensions.AddDefaultServices (cognitive 21) src/SharedWeb/Utilities/ServiceCollectionExtensions.cs:264
D2 · Cognitive Complexity
- Saml2OptionsExtensions.CouldHandleAsync (cognitive 21) bitwarden_license/src/Sso/Utilities/Saml2OptionsExtensions.cs:14
D2 · Cognitive Complexity
- CipherRequestModel.ToCipher (cognitive 20) src/Api/Vault/Models/Request/CipherRequestModel.cs:94
D2 · Cognitive Complexity
- InvoiceExtensions.FormatForProvider (cognitive 20) src/Core/Billing/Extensions/InvoiceExtensions.cs:16
D2 · Cognitive Complexity
- BulkSyncCohortAssignmentsCommand.Run (cognitive 20) src/Core/Billing/Organizations/PlanMigration/Commands/BulkSyncCohortAssignmentsCommand.cs:20
D2 · Cognitive Complexity
- SendValidationService.ValidateUserCanSaveAsync (cognitive 20) src/Core/Tools/SendFeatures/Services/SendValidationService.cs:41
D2 · Cognitive Complexity
- CreateCollectionsStep.Execute (cognitive 20) util/Seeder/Steps/CreateCollectionsStep.cs:28
D2 · Cognitive Complexity
- AzureQueueMailHostedService.ExecuteAsync (cognitive 19) src/Admin/HostedServices/AzureQueueMailHostedService.cs:52
D2 · Cognitive Complexity
- SelfHostedOrganizationDetails.CanUseLicense (cognitive 19) src/Core/AdminConsole/Models/Data/Organizations/SelfHostedOrganizationDetails.cs:25
D2 · Cognitive Complexity
- UpdateOrganizationUserCommand.UpdateUserAsync (cognitive 19) src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserCommand.cs:66
D2 · Cognitive Complexity
- PreviewOrganizationTaxCommand.Run (cognitive 19) src/Core/Billing/Organizations/Commands/PreviewOrganizationTaxCommand.cs:48
D2 · Cognitive Complexity
- CurrentContext.SetContextAsync (cognitive 19) src/Core/Context/CurrentContext.cs:98
D2 · Cognitive Complexity
- CipherService.SaveDetailsAsync (cognitive 19) src/Core/Vault/Services/Implementations/CipherService.cs:123
D2 · Cognitive Complexity
- ServiceCollectionExtensions.UseForwardedHeaders (cognitive 19) src/SharedWeb/Utilities/ServiceCollectionExtensions.cs:597
D2 · Cognitive Complexity
- ProviderBillingService.UpdateSeatMinimums (cognitive 19) bitwarden_license/src/Commercial.Core/Billing/Providers/Services/ProviderBillingService.cs:724
D2 · Cognitive Complexity
- CreateGroupsStep.Execute (cognitive 19) util/Seeder/Steps/CreateGroupsStep.cs:12
D2 · Cognitive Complexity
- EventsController.List (cognitive 18) src/Api/Dirt/Public/Controllers/EventsController.cs:56
D2 · Cognitive Complexity
- AdminRecoverAccountCommand.RecoverAccountAsync (cognitive 18) src/Core/AdminConsole/OrganizationFeatures/AccountRecovery/v2/AdminRecoverAccountCommand.cs:34
D2 · Cognitive Complexity
- LicensingService.LicensingService.ctor (cognitive 18) src/Core/Billing/Services/Implementations/LicensingService.cs:49
D2 · Cognitive Complexity
- SecretRepository.BuildSecretAccessQuery (cognitive 18) bitwarden_license/src/Commercial.Infrastructure.EntityFramework/SecretsManager/Repositories/SecretRepository.cs:476
D2 · Cognitive Complexity
- CreateGroupsStep.ComputeUsersPerGroup (cognitive 18) util/Seeder/Steps/CreateGroupsStep.cs:75
D2 · Cognitive Complexity
- SecretVersionsController.RestoreVersionAsync (cognitive 17) src/Api/SecretsManager/Controllers/SecretVersionsController.cs:181
D2 · Cognitive Complexity
- MultipartFormDataHelper.GetFileAsync (cognitive 17) src/Api/Utilities/MultipartFormDataHelper.cs:17
D2 · Cognitive Complexity
- StripeEventUtilityService.AttemptToPayInvoiceWithBraintreeAsync (cognitive 17) src/Billing/Services/Implementations/StripeEventUtilityService.cs:265
D2 · Cognitive Complexity
- AdminRecoverAccountValidator.ValidateAsync (cognitive 17) src/Core/AdminConsole/OrganizationFeatures/AccountRecovery/v2/AdminRecoverAccountValidator.cs:15
D2 · Cognitive Complexity
- CipherService.StorageBytesRemainingForCipherAsync (cognitive 17) src/Core/Vault/Services/Implementations/CipherService.cs:964
D2 · Cognitive Complexity
- CreateCipherFoldersStep.Execute (cognitive 17) util/Seeder/Steps/CreateCipherFoldersStep.cs:13
D2 · Cognitive Complexity
- GeneratePersonalCiphersStep.Execute (cognitive 17) util/Seeder/Steps/GeneratePersonalCiphersStep.cs:28
D2 · Cognitive Complexity
- ToolsController.GenerateLicense (cognitive 16) src/Admin/Controllers/ToolsController.cs:267
D2 · Cognitive Complexity
- TwoFactorYubiKeyResponseModel.TwoFactorYubiKeyResponseModel.ctor (cognitive 16) src/Api/Auth/Models/Response/TwoFactor/TwoFactorYubiKeyResponseModel.cs:12
D2 · Cognitive Complexity
- ProviderEventService.TryRecordInvoiceLineItems (cognitive 16) src/Billing/Services/Implementations/ProviderEventService.cs:24
D2 · Cognitive Complexity
- UpcomingInvoiceHandler.EnableAutomaticTaxAsync (cognitive 16) src/Billing/Services/Implementations/UpcomingInvoiceHandler.cs:923
D2 · Cognitive Complexity
- RemoveOrganizationUserCommand.RepositoryRemoveUserAsync (cognitive 16) src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/RemoveOrganizationUserCommand.cs:140
D2 · Cognitive Complexity
- AuthRequestService.UpdateAuthRequestAsync (cognitive 16) src/Core/Auth/Services/Implementations/AuthRequestService.cs:178
D2 · Cognitive Complexity
- RegisterUserCommand.RegisterUserViaOrganizationInviteToken (cognitive 16) src/Core/Auth/UserFeatures/Registration/Implementations/RegisterUserCommand.cs:111
D2 · Cognitive Complexity
- UpgradeOrganizationPlanVNextCommand.Run (cognitive 16) src/Core/Billing/Organizations/Commands/UpgradeOrganizationPlanVNextCommand.cs:55
D2 · Cognitive Complexity
- StripePaymentService.CancelAndRecoverChargesAsync (cognitive 16) src/Core/Billing/Services/Implementations/StripePaymentService.cs:298
D2 · Cognitive Complexity
- UpdateSecretsManagerSubscriptionCommand.ValidateSmSeatsUpdateAsync (cognitive 16) src/Core/OrganizationFeatures/OrganizationSubscriptions/UpdateSecretsManagerSubscriptionCommand.cs:255
D2 · Cognitive Complexity
- UpdateSecretsManagerSubscriptionCommand.ValidateSmServiceAccountsUpdateAsync (cognitive 16) src/Core/OrganizationFeatures/OrganizationSubscriptions/UpdateSecretsManagerSubscriptionCommand.cs:322
D2 · Cognitive Complexity
- AzureQueueHostedService.ExecuteAsync (cognitive 16) src/EventsProcessor/AzureQueueHostedService.cs:58
D2 · Cognitive Complexity
- IconsController.Get (cognitive 16) src/Icons/Controllers/IconsController.cs:55
D2 · Cognitive Complexity
- IconLink.StripIcoEmbeddedPngMetadata (cognitive 16) src/Icons/Models/IconLink.cs:284
D2 · Cognitive Complexity
- CertBuilder.BuildForInstall (cognitive 16) util/Setup/CertBuilder.cs:12
D21 · Naming Consistency
- LLM evaluation failed
D24 · Comment Value
- LLM evaluation failed
D36 · Supply-chain Provenance & Signing
- Unpinned build actions
D4 · Code Duplication
- Duplicated block (37 lines × 2) src/Core/AdminConsole/OrganizationFeatures/Organizations/CloudOrganizationSignUpCommand.cs:181
D4 · Code Duplication
- Duplicated block (28 lines × 2) src/Core/NotificationCenter/Commands/MarkNotificationDeletedCommand.cs:36
D4 · Code Duplication
- Duplicated block (27 lines × 2) src/Core/Utilities/CoreHelpers.cs:243
D4 · Code Duplication
- Duplicated block (26 lines × 2) src/Api/Dirt/Controllers/SlackIntegrationController.cs:48
D4 · Code Duplication
- Duplicated block (24 lines × 2) src/Core/Utilities/KdfSettingsValidator.cs:25
D4 · Code Duplication
- Duplicated block (18 lines × 2) src/Api/Models/Public/Response/ErrorResponseModel.cs:22
D4 · Code Duplication
- Duplicated block (16 lines × 3) src/Core/Dirt/Services/Implementations/SlackService.cs:111
D4 · Code Duplication
- Duplicated block (15 lines × 3) src/Api/AdminConsole/Models/Request/Organizations/OrganizationUserResetPasswordRequestModel.cs:40
D4 · Code Duplication
- Duplicated block (13 lines × 3) util/MySqlMigrations/MySqlDbMigrator.cs:26
D4 · Code Duplication
- Duplicated block (6 lines × 3) src/Infrastructure.EntityFramework/SecretsManager/Models/AccessPolicy.cs:19
D4 · Code Duplication
- Duplicated block (6 lines × 2) src/Core/Dirt/EventIntegrations/EventIntegrationsServiceCollectionExtensions.cs:403
D4 · Code Duplication
- Duplicated block (5 lines × 2) src/Core/Billing/Extensions/BillingExtensions.cs:17
Recommendation — 128 finding(s)
D17 · Explicit Debt
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/CollectionsController.cs:209
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/CollectionsController.cs:252
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/CollectionsController.cs:272
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/GroupsController.cs:219
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/GroupsController.cs:240
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/GroupsController.cs:265
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/GroupsController.cs:286
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs:160
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationDomainController.cs:121
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationsController.cs:239
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationsController.cs:327
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationsController.cs:481
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:469
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:534
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:552
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:580
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:608
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:637
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:670
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:694
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:711
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/OrganizationUsersController.cs:751
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/ProviderOrganizationsController.cs:106
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/ProvidersController.cs:89
- ObsoleteWithoutCallers src/Api/AdminConsole/Controllers/ProvidersController.cs:150
D10 · Test Quality
- No direct assertions: Post_UserClientExportedVault_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:57
- No direct assertions: Post_CipherClientAutofilled_WithValidCipher_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:72
- No direct assertions: Post_CipherClientCopiedPassword_WithValidCipher_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:90
- No direct assertions: Post_CipherClientCopiedHiddenField_WithValidCipher_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:108
- No direct assertions: Post_CipherClientCopiedCardCode_WithValidCipher_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:126
- No direct assertions: Post_CipherClientToggledCardNumberVisible_WithValidCipher_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:144
- No direct assertions: Post_CipherClientToggledCardCodeVisible_WithValidCipher_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:162
- No direct assertions: Post_CipherClientToggledHiddenFieldVisible_WithValidCipher_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:180
- No direct assertions: Post_CipherClientToggledPasswordVisible_WithValidCipher_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:198
- No direct assertions: Post_CipherClientViewed_WithValidCipher_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:216
- No direct assertions: Post_CipherEvent_WithoutCipherId_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:234
- No direct assertions: Post_CipherEvent_WithInvalidCipherId_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:249
- No direct assertions: Post_OrganizationClientExportedVault_WithValidOrganization_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:265
- No direct assertions: Post_OrganizationClientExportedVault_WithoutOrganizationId_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:283
- No direct assertions: Post_OrganizationClientExportedVault_WithInvalidOrganizationId_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:298
- No direct assertions: Post_MultipleEvents_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:314
- No direct assertions: Post_CipherEventsBatch_MoreThan50Items_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:350
- No direct assertions: Post_UnsupportedEventType_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:370
- No direct assertions: Post_MixedValidAndInvalidEvents_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:386
- No direct assertions: Post_CipherCaching_MultipleEventsForSameCipher_Success test/Events.IntegrationTest/Controllers/CollectControllerTests.cs:415
D17 · Explicit Debt
- DuplicateNoWarn src/Core/Core.csproj:15
- DuplicateNoWarn src/Core/Core.csproj:15
- DuplicateNoWarn src/Core/Core.csproj:15
- DuplicateNoWarn src/Core/Core.csproj:15
- DuplicateNoWarn src/Api/Api.csproj:18
- DuplicateNoWarn src/Api/Api.csproj:18
- DuplicateNoWarn src/Api/Api.csproj:18
D31 · IaC & Container Security
- Low IaC: DS-0026 util/MsSqlMigratorUtility/Dockerfile
- Low IaC: DS-0026 util/Setup/Dockerfile
D38 · OSV Dependency Vulnerabilities
- Low CVE: [GHSA redacted] util/RustSdk/rust/Cargo.lock
- Low CVE: [GHSA redacted] util/RustSdk/rust/Cargo.lock
D11 · Test Reliability
- Tier not included (time budget)
D14 · License Compliance
- License scan unavailable
D20 · ADR Quality
- No ADRs found
D25 · ADR Conformance
- no ADRs to check
D28 · Secrets (history)
- Rotate the exposed credentials — git history can't be un-committed
D32 · Data Compliance (PII/GDPR)
- Not applicable
D34 · Knowledge Freshness
- early-stage repository — too little history to judge knowledge freshness
D36 · Supply-chain Provenance & Signing
- No build provenance
D36 · Supply-chain Provenance & Signing
- No SBOM
D7 · Architectural Integrity
- No checkable ADRs to assess
Info — 425 finding(s)
D12 · Dependency Hygiene
- Outdated: Aspire.Hosting.AppHost
- Outdated: Aspire.Hosting.Azure.Storage
- Outdated: Aspire.Hosting.JavaScript
- Outdated: Aspire.Hosting.SqlServer
- Outdated: BenchmarkDotNet
- Outdated: OpenTelemetry.Exporter.OpenTelemetryProtocol
- Outdated: OpenTelemetry.Extensions.Hosting
- Outdated: OpenTelemetry.Instrumentation.AspNetCore
- Outdated: OpenTelemetry.Instrumentation.EntityFrameworkCore
- Outdated: OpenTelemetry.Instrumentation.Http
- Outdated: OpenTelemetry.Instrumentation.Runtime
- Outdated: OpenTelemetry.Instrumentation.SqlClient
- Outdated: AspNetCore.HealthChecks.SqlServer
- Outdated: AspNetCore.HealthChecks.Uris
- Outdated: OpenTelemetry.Exporter.OpenTelemetryProtocol
- Outdated: OpenTelemetry.Extensions.Hosting
- Outdated: OpenTelemetry.Instrumentation.AspNetCore
- Outdated: OpenTelemetry.Instrumentation.EntityFrameworkCore
- Outdated: OpenTelemetry.Instrumentation.Http
- Outdated: OpenTelemetry.Instrumentation.Runtime
- Outdated: OpenTelemetry.Instrumentation.SqlClient
- Outdated: Swashbuckle.AspNetCore
- Outdated: MarkDig
- Outdated: OpenTelemetry.Exporter.OpenTelemetryProtocol
- Outdated: OpenTelemetry.Extensions.Hosting
D10 · Test Quality
- Skipped (documented): ExternalCallback_WithInvalidProviderGuid_ReturnsError bitwarden_license/test/Sso.IntegrationTest/Controllers/AccountControllerTests.cs:613
- Skipped (documented): ExternalCallback_WithNonExistentOrganization_ReturnsError bitwarden_license/test/Sso.IntegrationTest/Controllers/AccountControllerTests.cs:651
- Skipped (documented): UpdateGroup_WithUsersAndCollections test/Api.IntegrationTest/AdminConsole/Controllers/GroupsControllerPerformanceTests.cs:23
- Skipped (documented): DeleteOrganization_WithPasswordVerification test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationsControllerPerformanceTests.cs:26
- Skipped (documented): DeleteOrganization_WithTokenVerification test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationsControllerPerformanceTests.cs:77
- Skipped (documented): CreateOrganization_WithoutPayment test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationsControllerPerformanceTests.cs:131
- Skipped (documented): GetAllUsers_WithCollections test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:25
- Skipped (documented): GetAllUsers_MiniDetails test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:64
- Skipped (documented): GetSingleUser_WithGroups test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:104
- Skipped (documented): GetResetPasswordDetails_ForSingleUser test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:139
- Skipped (documented): BulkConfirmUsers test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:172
- Skipped (documented): BulkRemoveUsers test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:223
- Skipped (documented): BulkRevokeUsers test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:266
- Skipped (documented): BulkRestoreUsers test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:313
- Skipped (documented): BulkDeleteAccounts test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:360
- Skipped (documented): UpdateSingleUser_WithCollectionsAndGroups test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:411
- Skipped (documented): BulkEnableSecretsManager test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:461
- Skipped (documented): DeleteSingleUserAccount_FromVerifiedDomain test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:504
- Skipped (documented): InviteUsers test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:545
- Skipped (documented): BulkReinviteUsers test/Api.IntegrationTest/AdminConsole/Controllers/OrganizationUsersControllerPerformanceTests.cs:596
- Skipped (documented): SendEmailAsync_Works_NoSsl test/Core.IntegrationTest/MailKitSmtpMailDeliveryServiceTests.cs:199
- Skipped (documented): AcceptUserAsync_EmergencyAccessEmailDoesNotMatch_ThrowsBadRequest test/Core.Test/Auth/UserFeatures/EmergencyAccess/EmergencyAccessServiceTests.cs:417
- Skipped (documented): ServiceExists test/Core.Test/Dirt/Services/AzureQueueEventWriteServiceTests.cs:28
- Skipped (documented): ValidateSponsorshipAsync_NoSponsoredOrg_EarlyReturn test/Core.Test/OrganizationFeatures/OrganizationSponsorships/FamiliesForEnterprise/Cloud/ValidateSponsorshipCommandTests.cs:18
- Skipped (documented): ValidateSponsorshipAsync_NoExistingSponsorship_UpdatesStripePlan test/Core.Test/OrganizationFeatures/OrganizationSponsorships/FamiliesForEnterprise/Cloud/ValidateSponsorshipCommandTests.cs:32
D17 · Explicit Debt
- Justified suppression src/Billing/Controllers/BitPayController.cs:133
- Justified suppression src/Core/Billing/Services/Implementations/StripePaymentService.cs:907
- Justified suppression src/Core/Billing/Services/Implementations/StripePaymentService.cs:948
- Justified suppression src/Core/HostedServices/ApplicationCacheHostedService.cs:61
- Justified suppression src/Core/Platform/Push/IPushNotificationService.cs:90
- Justified suppression src/Core/Platform/Push/IPushNotificationService.cs:106
- Justified suppression src/Core/Platform/Push/IPushNotificationService.cs:122
- Justified suppression src/Core/Platform/Push/IPushNotificationService.cs:138
- Justified suppression src/Core/Platform/Push/IPushNotificationService.cs:154
- Justified suppression src/Core/Platform/Push/IPushNotificationService.cs:252
- Justified suppression src/Core/Platform/Push/IPushNotificationService.cs:269
- Justified suppression src/Core/Platform/Push/IPushNotificationService.cs:285
- Justified suppression src/Core/Platform/Push/IPushNotificationService.cs:312
- Justified suppression src/Core/Platform/Push/IPushNotificationService.cs:331
- Justified suppression src/Core/Platform/Push/IPushNotificationService.cs:347
- Justified suppression src/Core/Platform/Push/IPushNotificationService.cs:417
- Justified suppression src/Core/Services/Implementations/UserService.cs:282
- Justified suppression src/Core/Services/Implementations/UserService.cs:283
- Justified suppression src/Icons/Models/IconLink.cs:123
- Justified suppression src/SharedWeb/Utilities/ServiceCollectionExtensions.cs:615
- Justified suppression bitwarden_license/test/SSO.Test/Controllers/AccountControllerTest.cs:391
- Justified suppression bitwarden_license/test/SSO.Test/Controllers/AccountControllerTest.cs:459
- Justified suppression bitwarden_license/test/SSO.Test/Controllers/AccountControllerTest.cs:518
- Justified suppression test/Api.Test/Auth/Controllers/AccountsControllerTests.cs:368
- Justified suppression test/Api.Test/Auth/Controllers/AccountsControllerTests.cs:387
D10 · Test Quality
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
- Mock framework: NSubstitute
D18 · Solution Shape
- Build did not complete in the analyzer
D18 · Solution Shape
- AppHost (Production) AppHost/AppHost.csproj
D18 · Solution Shape
- MicroBenchmarks (Production) perf/MicroBenchmarks/MicroBenchmarks.csproj
D18 · Solution Shape
- Admin (Production) src/Admin/Admin.csproj
D18 · Solution Shape
- Api (Production) src/Api/Api.csproj
D18 · Solution Shape
- Billing (Production) src/Billing/Billing.csproj
D18 · Solution Shape
- Core (Production) src/Core/Core.csproj
D18 · Solution Shape
- Events (Production) src/Events/Events.csproj
D18 · Solution Shape
- EventsProcessor (Production) src/EventsProcessor/EventsProcessor.csproj
D18 · Solution Shape
- Icons (Production) src/Icons/Icons.csproj
D18 · Solution Shape
- Identity (Production) src/Identity/Identity.csproj
D18 · Solution Shape
- Infrastructure.Dapper (Production) src/Infrastructure.Dapper/Infrastructure.Dapper.csproj
D18 · Solution Shape
- Infrastructure.EntityFramework (Production) src/Infrastructure.EntityFramework/Infrastructure.EntityFramework.csproj
D18 · Solution Shape
- Notifications (Production) src/Notifications/Notifications.csproj
D18 · Solution Shape
- SharedWeb (Production) src/SharedWeb/SharedWeb.csproj
D18 · Solution Shape
- Commercial.Core (Production) bitwarden_license/src/Commercial.Core/Commercial.Core.csproj
D18 · Solution Shape
- Commercial.Infrastructure.EntityFramework (Production) bitwarden_license/src/Commercial.Infrastructure.EntityFramework/Commercial.Infrastructure.EntityFramework.csproj
D18 · Solution Shape
- Scim (Production) bitwarden_license/src/Scim/Scim.csproj
D18 · Solution Shape
- Sso (Production) bitwarden_license/src/Sso/Sso.csproj
D18 · Solution Shape
- Commercial.Core.Test (Test) bitwarden_license/test/Commercial.Core.Test/Commercial.Core.Test.csproj
D18 · Solution Shape
- Scim.IntegrationTest (Test) bitwarden_license/test/Scim.IntegrationTest/Scim.IntegrationTest.csproj
D18 · Solution Shape
- Scim.Test (Test) bitwarden_license/test/Scim.Test/Scim.Test.csproj
D18 · Solution Shape
- Sso.IntegrationTest (Test) bitwarden_license/test/Sso.IntegrationTest/Sso.IntegrationTest.csproj
D18 · Solution Shape
- SSO.Test (Test) bitwarden_license/test/SSO.Test/SSO.Test.csproj
D18 · Solution Shape
- Admin.Test (Test) test/Admin.Test/Admin.Test.csproj
D18 · Solution Shape
- Api.IntegrationTest (Test) test/Api.IntegrationTest/Api.IntegrationTest.csproj
D18 · Solution Shape
- Api.Test (Test) test/Api.Test/Api.Test.csproj
D18 · Solution Shape
- Billing.Test (Test) test/Billing.Test/Billing.Test.csproj
D18 · Solution Shape
- Common (Test) test/Common/Common.csproj
D18 · Solution Shape
- Core.IntegrationTest (Test) test/Core.IntegrationTest/Core.IntegrationTest.csproj
D18 · Solution Shape
- Core.Test (Test) test/Core.Test/Core.Test.csproj
D18 · Solution Shape
- Events.IntegrationTest (Test) test/Events.IntegrationTest/Events.IntegrationTest.csproj
D18 · Solution Shape
- Events.Test (Test) test/Events.Test/Events.Test.csproj
D18 · Solution Shape
- EventsProcessor.Test (Test) test/EventsProcessor.Test/EventsProcessor.Test.csproj
D18 · Solution Shape
- Icons.Test (Test) test/Icons.Test/Icons.Test.csproj
D18 · Solution Shape
- Identity.IntegrationTest (Test) test/Identity.IntegrationTest/Identity.IntegrationTest.csproj
D18 · Solution Shape
- Identity.Test (Test) test/Identity.Test/Identity.Test.csproj
D18 · Solution Shape
- Infrastructure.Dapper.Test (Test) test/Infrastructure.Dapper.Test/Infrastructure.Dapper.Test.csproj
D18 · Solution Shape
- Infrastructure.EFIntegration.Test (Test) test/Infrastructure.EFIntegration.Test/Infrastructure.EFIntegration.Test.csproj
D18 · Solution Shape
- Infrastructure.IntegrationTest (Test) test/Infrastructure.IntegrationTest/Infrastructure.IntegrationTest.csproj
D18 · Solution Shape
- IntegrationTestCommon (Production) test/IntegrationTestCommon/IntegrationTestCommon.csproj
D18 · Solution Shape
- Notifications.Test (Test) test/Notifications.Test/Notifications.Test.csproj
D18 · Solution Shape
- SeederApi.IntegrationTest (Test) test/SeederApi.IntegrationTest/SeederApi.IntegrationTest.csproj
D18 · Solution Shape
- Server.IntegrationTest (Test) test/Server.IntegrationTest/Server.IntegrationTest.csproj
D18 · Solution Shape
- Setup.Test (Test) test/Setup.Test/Setup.Test.csproj
D18 · Solution Shape
- SharedWeb.Test (Test) test/SharedWeb.Test/SharedWeb.Test.csproj
D18 · Solution Shape
- Migrator (Production) util/Migrator/Migrator.csproj
D18 · Solution Shape
- MsSqlMigratorUtility (Production) util/MsSqlMigratorUtility/MsSqlMigratorUtility.csproj
D18 · Solution Shape
- MySqlMigrations (Production) util/MySqlMigrations/MySqlMigrations.csproj
D18 · Solution Shape
- PostgresMigrations (Production) util/PostgresMigrations/PostgresMigrations.csproj
D18 · Solution Shape
- RustSdk (Production) util/RustSdk/RustSdk.csproj
D18 · Solution Shape
- Seeder (Production) util/Seeder/Seeder.csproj
D18 · Solution Shape
- SeederApi (Production) util/SeederApi/SeederApi.csproj
D18 · Solution Shape
- SeederUtility (Production) util/SeederUtility/SeederUtility.csproj
D18 · Solution Shape
- Server (Production) util/Server/Server.csproj
D18 · Solution Shape
- Setup (Production) util/Setup/Setup.csproj
D18 · Solution Shape
- SqliteMigrations (Production) util/SqliteMigrations/SqliteMigrations.csproj
D18 · Solution Shape
- SqlServerEFScaffold (Production) util/SqlServerEFScaffold/SqlServerEFScaffold.csproj
D22 · Internal API Consistency
- No exposed public API
D9 · Test Distribution
- Unit tests
D9 · Test Distribution
- Integration tests
D9 · Test Distribution
- BDD tests
D9 · Test Distribution
- E2E tests
Appendix B — Reproduction & audit trail
| Dimension | Tool | Version | Command | Findings | Raw output |
|---|---|---|---|---|---|
| D28 · Secrets (history) | gitleaks | — | gitleaks detect --no-banner --report-format json --report-path /dev/stdout --exit-code 0 --source . | 3 | artifacts/raw/gitleaks.json |
| D29 · Static Analysis (SAST) | semgrep | — | semgrep --config auto --json --quiet --timeout 0 --metrics off . | 0 | — |
| D30 · Dependency Vulnerabilities | dotnet | — | dotnet list bitwarden-server.slnx package --vulnerable --include-transitive --format json | 4 | artifacts/raw/dotnet-vulnerable.json |
| D31 · IaC & Container Security | trivy | — | trivy config --format json --quiet . | 20 | artifacts/raw/trivy-config.json |
| D32 · Data Compliance (PII/GDPR) | semgrep | — | semgrep: not applicable — No PII/GDPR-handling patterns detected (p/gdpr ruleset) — no data-compliance surface to assess. | 0 | — |
| D33 · JS/npm Dependency Vulnerabilities | trivy | — | trivy fs --scanners vuln --format json --quiet --severity CRITICAL,HIGH,MEDIUM,LOW --skip-dirs **/bin/** --skip-dirs **/obj/** . | 16 | artifacts/raw/trivy-fs.json |
| D38 · OSV Dependency Vulnerabilities | osv-scanner | — | osv-scanner --format json --recursive . | 39 | artifacts/raw/osv-scanner.json |
Appendix C — Personal-data map
Email — 222 field(s)
- BaseScimUserModel.Emails bitwarden_license/src/Scim/Models/BaseScimUserModel.cs:20
- BaseScimUserModel.PrimaryEmail bitwarden_license/src/Scim/Models/BaseScimUserModel.cs:21
- BaseScimUserModel.WorkEmail bitwarden_license/src/Scim/Models/BaseScimUserModel.cs:22
- OpenIdConnectScopes.Email bitwarden_license/src/Sso/Utilities/OpenIdConnectScopes.cs:32
- SamlClaimTypes.Email bitwarden_license/src/Sso/Utilities/SamlClaimTypes.cs:5
- SamlNameIdFormats.Email bitwarden_license/src/Sso/Utilities/SamlNameIdFormats.cs:7
- CreateBusinessUnitProviderModel.OwnerEmail src/Admin/AdminConsole/Models/CreateBusinessUnitProviderModel.cs:15
- CreateMspProviderModel.OwnerEmail src/Admin/AdminConsole/Models/CreateMspProviderModel.cs:14
- CreateResellerProviderModel.BillingEmail src/Admin/AdminConsole/Models/CreateResellerProviderModel.cs:20
- OrganizationEditModel.BillingEmail src/Admin/AdminConsole/Models/OrganizationEditModel.cs:131
- OrganizationInitiateDeleteModel.AdminEmail src/Admin/AdminConsole/Models/OrganizationInitiateDeleteModel.cs:14
- OrganizationUnassignedToProviderSearchViewModel.OrganizationOwnerEmail src/Admin/AdminConsole/Models/OrganizationUnassignedToProviderSearchViewModel.cs:15
- OrganizationsModel.UserEmail src/Admin/AdminConsole/Models/OrganizationsModel.cs:12
- ProviderEditModel.BillingEmail src/Admin/AdminConsole/Models/ProviderEditModel.cs:53
- ProvidersModel.UserEmail src/Admin/AdminConsole/Models/ProvidersModel.cs:12
- LoginModel.Email src/Admin/Auth/Models/LoginModel.cs:12
- BusinessUnitConversionModel.ProviderAdminEmail src/Admin/Billing/Models/BusinessUnitConversionModel.cs:13
- UserEditModel.Email src/Admin/Models/UserEditModel.cs:60
- UserEditModel.EmailVerified src/Admin/Models/UserEditModel.cs:62
- UserViewModel.Email src/Admin/Models/UserViewModel.cs:14
- UserViewModel.EmailVerified src/Admin/Models/UserViewModel.cs:19
- UserViewModel.LastEmailChangeDate src/Admin/Models/UserViewModel.cs:24
- UsersModel.Email src/Admin/Models/UsersModel.cs:8
- OrganizationCreateRequestModel.BillingEmail src/Api/AdminConsole/Models/Request/Organizations/OrganizationCreateRequestModel.cs:29
- OrganizationDomainSsoDetailsRequestModel.Email src/Api/AdminConsole/Models/Request/Organizations/OrganizationDomainSsoDetailsRequestModel.cs:12
- OrganizationInviteLinkValidateEmailDomainRequestModel.Email src/Api/AdminConsole/Models/Request/Organizations/OrganizationInviteLinkValidateEmailDomainRequestModel.cs:12
- OrganizationNoPaymentCreateRequest.BillingEmail src/Api/AdminConsole/Models/Request/Organizations/OrganizationNoPaymentCreateRequest.cs:28
- OrganizationUpdateRequestModel.BillingEmail src/Api/AdminConsole/Models/Request/Organizations/OrganizationUpdateRequestModel.cs:16
- OrganizationUserInviteRequestModel.Emails src/Api/AdminConsole/Models/Request/Organizations/OrganizationUserRequestModels.cs:18
- ProviderOrganizationCreateRequestModel.ClientOwnerEmail src/Api/AdminConsole/Models/Request/Providers/ProviderOrganizationCreateRequestModel.cs:15
- ProviderSetupRequestModel.BillingEmail src/Api/AdminConsole/Models/Request/Providers/ProviderSetupRequestModel.cs:24
- ProviderUpdateRequestModel.BillingEmail src/Api/AdminConsole/Models/Request/Providers/ProviderUpdateRequestModel.cs:24
- ProviderUserInviteRequestModel.Emails src/Api/AdminConsole/Models/Request/Providers/ProviderUserRequestModels.cs:15
- CollectionResponseModel.DefaultUserCollectionEmail src/Api/AdminConsole/Models/Response/CollectionResponseModel.cs:35
- OrganizationResponseModel.BillingEmail src/Api/AdminConsole/Models/Response/Organizations/OrganizationResponseModel.cs:94
- OrganizationUserUserMiniDetailsResponseModel.Email src/Api/AdminConsole/Models/Response/Organizations/OrganizationUserResponseModel.cs:126
- OrganizationUserUserDetailsResponseModel.Email src/Api/AdminConsole/Models/Response/Organizations/OrganizationUserResponseModel.cs:176
- PendingOrganizationAuthRequestResponseModel.Email src/Api/AdminConsole/Models/Response/PendingOrganizationAuthRequestResponseModel.cs:36
- ProviderResponseModel.BillingEmail src/Api/AdminConsole/Models/Response/Providers/ProviderResponseModel.cs:43
- ProviderUserUserDetailsResponseModel.Email src/Api/AdminConsole/Models/Response/Providers/ProviderUserResponseModel.cs:64
Government ID (SSN / passport / tax) — 46 field(s)
- OrganizationCreateRequestModel.TaxIdNumber src/Api/AdminConsole/Models/Request/Organizations/OrganizationCreateRequestModel.cs:53
- OrganizationNoPaymentCreateRequest.TaxIdNumber src/Api/AdminConsole/Models/Request/Organizations/OrganizationNoPaymentCreateRequest.cs:52
- CheckoutBillingAddressRequest.TaxId src/Api/Billing/Models/Requests/Payment/CheckoutBillingAddressRequest.cs:8
- ExpandedTaxInfoUpdateRequestModel.TaxId src/Api/Models/Request/ExpandedTaxInfoUpdateRequestModel.cs:10
- TaxInfoResponseModel.TaxIdNumber src/Api/Models/Response/TaxInfoResponseModel.cs:29
- TaxInfoResponseModel.TaxIdType src/Api/Models/Response/TaxInfoResponseModel.cs:30
- CipherIdentityModel.SSN src/Api/Vault/Models/CipherIdentityModel.cs:80
- CipherIdentityModel.PassportNumber src/Api/Vault/Models/CipherIdentityModel.cs:86
- CipherPassportModel.PassportNumber src/Api/Vault/Models/CipherPassportModel.cs:53
- CipherPassportModel.PassportType src/Api/Vault/Models/CipherPassportModel.cs:57
- CipherPassportModel.NationalIdentificationNumber src/Api/Vault/Models/CipherPassportModel.cs:77
- CipherRequestModel.Passport src/Api/Vault/Models/Request/CipherRequestModel.cs:60
- CipherMiniResponseModel.Passport src/Api/Vault/Models/Response/CipherResponseModel.cs:129
- ErrorCodes.TaxIdInvalid src/Core/Billing/Constants/StripeConstants.cs:64
- OrganizationWarnings.TaxId src/Core/Billing/Organizations/Models/OrganizationWarnings.cs:8
- BillingAddress.TaxId src/Core/Billing/Payment/Models/BillingAddress.cs:15
- ProviderWarnings.TaxId src/Core/Billing/Providers/Models/ProviderWarnings.cs:6
- StripeAdapter._taxIdService src/Core/Billing/Services/Implementations/StripeAdapter.cs:22
- TaxInformation.TaxId src/Core/Billing/Tax/Models/TaxInformation.cs:8
- TaxInformation.TaxIdType src/Core/Billing/Tax/Models/TaxInformation.cs:9
- TaxInformationRequestModel.TaxId src/Core/Billing/Tax/Requests/TaxInformationRequestModel.cs:16
- TaxService._taxIdTypes src/Core/Billing/Tax/Services/Implementations/TaxService.cs:15
- TaxInfo.TaxIdNumber src/Core/Models/Business/TaxInfo.cs:8
- TaxInfo.TaxIdType src/Core/Models/Business/TaxInfo.cs:9
- CipherIdentityData.SSN src/Core/Vault/Models/Data/CipherIdentityData.cs:24
- CipherIdentityData.PassportNumber src/Core/Vault/Models/Data/CipherIdentityData.cs:26
- CipherPassportData.PassportNumber src/Core/Vault/Models/Data/CipherPassportData.cs:13
- CipherPassportData.PassportType src/Core/Vault/Models/Data/CipherPassportData.cs:14
- CipherPassportData.NationalIdentificationNumber src/Core/Vault/Models/Data/CipherPassportData.cs:19
- CipherViewDto.Passport util/Seeder/Models/CipherViewDto.cs:53
- CipherTypes.Passport util/Seeder/Models/CipherViewDto.cs:193
- IdentityViewDto.SSN util/Seeder/Models/CipherViewDto.cs:295
- IdentityViewDto.PassportNumber util/Seeder/Models/CipherViewDto.cs:303
- PassportViewDto.PassportNumber util/Seeder/Models/CipherViewDto.cs:436
- PassportViewDto.PassportType util/Seeder/Models/CipherViewDto.cs:439
- PassportViewDto.NationalIdentificationNumber util/Seeder/Models/CipherViewDto.cs:454
- EncryptedCipherDto.Passport util/Seeder/Models/EncryptedCipherDto.cs:53
- EncryptedIdentityDto.SSN util/Seeder/Models/EncryptedCipherDto.cs:233
- EncryptedIdentityDto.PassportNumber util/Seeder/Models/EncryptedCipherDto.cs:239
- EncryptedPassportDto.PassportNumber util/Seeder/Models/EncryptedCipherDto.cs:353
Address — 44 field(s)
- OrganizationCreateRequestModel.BillingAddressLine1 src/Api/AdminConsole/Models/Request/Organizations/OrganizationCreateRequestModel.cs:55
- OrganizationCreateRequestModel.BillingAddressLine2 src/Api/AdminConsole/Models/Request/Organizations/OrganizationCreateRequestModel.cs:57
- OrganizationCreateRequestModel.BillingAddressCity src/Api/AdminConsole/Models/Request/Organizations/OrganizationCreateRequestModel.cs:59
- OrganizationCreateRequestModel.BillingAddressState src/Api/AdminConsole/Models/Request/Organizations/OrganizationCreateRequestModel.cs:61
- OrganizationCreateRequestModel.BillingAddressPostalCode src/Api/AdminConsole/Models/Request/Organizations/OrganizationCreateRequestModel.cs:63
- OrganizationCreateRequestModel.BillingAddressCountry src/Api/AdminConsole/Models/Request/Organizations/OrganizationCreateRequestModel.cs:66
- OrganizationNoPaymentCreateRequest.BillingAddressLine1 src/Api/AdminConsole/Models/Request/Organizations/OrganizationNoPaymentCreateRequest.cs:54
- OrganizationNoPaymentCreateRequest.BillingAddressLine2 src/Api/AdminConsole/Models/Request/Organizations/OrganizationNoPaymentCreateRequest.cs:56
- OrganizationNoPaymentCreateRequest.BillingAddressCity src/Api/AdminConsole/Models/Request/Organizations/OrganizationNoPaymentCreateRequest.cs:58
- OrganizationNoPaymentCreateRequest.BillingAddressState src/Api/AdminConsole/Models/Request/Organizations/OrganizationNoPaymentCreateRequest.cs:60
- OrganizationNoPaymentCreateRequest.BillingAddressPostalCode src/Api/AdminConsole/Models/Request/Organizations/OrganizationNoPaymentCreateRequest.cs:62
- OrganizationNoPaymentCreateRequest.BillingAddressCountry src/Api/AdminConsole/Models/Request/Organizations/OrganizationNoPaymentCreateRequest.cs:65
- OrganizationUpgradeRequestModel.BillingAddressCountry src/Api/AdminConsole/Models/Request/Organizations/OrganizationUpgradeRequestModel.cs:26
- OrganizationUpgradeRequestModel.BillingAddressPostalCode src/Api/AdminConsole/Models/Request/Organizations/OrganizationUpgradeRequestModel.cs:27
- ProviderSetupRequestModel.BillingAddress src/Api/AdminConsole/Models/Request/Providers/ProviderSetupRequestModel.cs:32
- MinimalBillingAddressRequest.PostalCode src/Api/Billing/Models/Requests/Payment/MinimalBillingAddressRequest.cs:12
- TokenizedPaymentMethodRequest.BillingAddress src/Api/Billing/Models/Requests/Payment/TokenizedPaymentMethodRequest.cs:7
- PremiumCloudHostedSubscriptionRequest.BillingAddress src/Api/Billing/Models/Requests/Premium/PremiumCloudHostedSubscriptionRequest.cs:15
- UpgradePremiumToOrganizationRequest.BillingAddress src/Api/Billing/Models/Requests/Premium/UpgradePremiumToOrganizationRequest.cs:29
- PreviewOrganizationSubscriptionPlanChangeTaxRequest.BillingAddress src/Api/Billing/Models/Requests/PreviewInvoice/PreviewOrganizationSubscriptionPlanChangeTaxRequest.cs:15
- PreviewOrganizationSubscriptionPurchaseTaxRequest.BillingAddress src/Api/Billing/Models/Requests/PreviewInvoice/PreviewOrganizationSubscriptionPurchaseTaxRequest.cs:15
- PreviewPremiumSubscriptionPurchaseTaxRequest.BillingAddress src/Api/Billing/Models/Requests/PreviewInvoice/PreviewPremiumSubscriptionPurchaseTaxRequest.cs:15
- PreviewPremiumUpgradeProrationRequest.BillingAddress src/Api/Billing/Models/Requests/PreviewInvoice/PreviewPremiumUpgradeProrationRequest.cs:16
- RestartSubscriptionRequest.BillingAddress src/Api/Billing/Models/Requests/Subscriptions/RestartSubscriptionRequest.cs:12
- PremiumRequestModel.PostalCode src/Api/Models/Request/Accounts/PremiumRequestModel.cs:20
- TaxInfoUpdateRequestModel.PostalCode src/Api/Models/Request/Accounts/TaxInfoUpdateRequestModel.cs:13
- TaxInfoResponseModel.PostalCode src/Api/Models/Response/TaxInfoResponseModel.cs:35
- CipherIdentityModel.PostalCode src/Api/Vault/Models/CipherIdentityModel.cs:65
- BillingAddress.PostalCode src/Core/Billing/Payment/Models/BillingAddress.cs:10
- PremiumSubscriptionPurchase.BillingAddress src/Core/Billing/Premium/Models/PremiumSubscriptionPurchase.cs:8
- TaxInformation.PostalCode src/Core/Billing/Tax/Models/TaxInformation.cs:7
- TaxInformationRequestModel.PostalCode src/Core/Billing/Tax/Requests/TaxInformationRequestModel.cs:14
- TaxRate.PostalCode src/Core/Entities/TaxRate.cs:16
- TaxInfo.BillingAddressLine1 src/Core/Models/Business/TaxInfo.cs:11
- TaxInfo.BillingAddressLine2 src/Core/Models/Business/TaxInfo.cs:12
- TaxInfo.BillingAddressCity src/Core/Models/Business/TaxInfo.cs:13
- TaxInfo.BillingAddressState src/Core/Models/Business/TaxInfo.cs:14
- TaxInfo.BillingAddressPostalCode src/Core/Models/Business/TaxInfo.cs:15
- TaxInfo.BillingAddressCountry src/Core/Models/Business/TaxInfo.cs:16
- CipherIdentityData.PostalCode src/Core/Vault/Models/Data/CipherIdentityData.cs:19
Name — 40 field(s)
- NameModel.GivenName bitwarden_license/src/Scim/Models/BaseScimUserModel.cs:38
- NameModel.FamilyName bitwarden_license/src/Scim/Models/BaseScimUserModel.cs:40
- SamlClaimTypes.GivenName bitwarden_license/src/Sso/Utilities/SamlClaimTypes.cs:6
- SamlClaimTypes.Surname bitwarden_license/src/Sso/Utilities/SamlClaimTypes.cs:7
- CipherDriversLicenseModel.FirstName src/Api/Vault/Models/CipherDriversLicenseModel.cs:27
- CipherDriversLicenseModel.LastName src/Api/Vault/Models/CipherDriversLicenseModel.cs:35
- CipherIdentityModel.FirstName src/Api/Vault/Models/CipherIdentityModel.cs:41
- CipherIdentityModel.LastName src/Api/Vault/Models/CipherIdentityModel.cs:47
- CipherPassportModel.Surname src/Api/Vault/Models/CipherPassportModel.cs:29
- CipherPassportModel.GivenName src/Api/Vault/Models/CipherPassportModel.cs:33
- CipherDriversLicenseData.FirstName src/Core/Vault/Models/Data/CipherDriversLicenseData.cs:7
- CipherDriversLicenseData.LastName src/Core/Vault/Models/Data/CipherDriversLicenseData.cs:9
- CipherIdentityData.FirstName src/Core/Vault/Models/Data/CipherIdentityData.cs:11
- CipherIdentityData.LastName src/Core/Vault/Models/Data/CipherIdentityData.cs:13
- CipherPassportData.Surname src/Core/Vault/Models/Data/CipherPassportData.cs:7
- CipherPassportData.GivenName src/Core/Vault/Models/Data/CipherPassportData.cs:8
- CipherUsernameGenerator._firstNames util/Seeder/Data/Generators/CipherUsernameGenerator.cs:45
- CipherUsernameGenerator._lastNames util/Seeder/Data/Generators/CipherUsernameGenerator.cs:47
- IdentityViewDto.FirstName util/Seeder/Models/CipherViewDto.cs:243
- IdentityViewDto.LastName util/Seeder/Models/CipherViewDto.cs:251
- DriversLicenseViewDto.FirstName util/Seeder/Models/CipherViewDto.cs:379
- DriversLicenseViewDto.LastName util/Seeder/Models/CipherViewDto.cs:385
- PassportViewDto.Surname util/Seeder/Models/CipherViewDto.cs:418
- PassportViewDto.GivenName util/Seeder/Models/CipherViewDto.cs:421
- EncryptedIdentityDto.FirstName util/Seeder/Models/EncryptedCipherDto.cs:194
- EncryptedIdentityDto.LastName util/Seeder/Models/EncryptedCipherDto.cs:200
- EncryptedDriversLicenseDto.FirstName util/Seeder/Models/EncryptedCipherDto.cs:299
- EncryptedDriversLicenseDto.LastName util/Seeder/Models/EncryptedCipherDto.cs:305
- EncryptedPassportDto.Surname util/Seeder/Models/EncryptedCipherDto.cs:335
- EncryptedPassportDto.GivenName util/Seeder/Models/EncryptedCipherDto.cs:338
- SeedIdentity.FirstName util/Seeder/Models/SeedModels.cs:55
- SeedIdentity.LastName util/Seeder/Models/SeedModels.cs:57
- SeedRosterUser.FirstName util/Seeder/Models/SeedModels.cs:96
- SeedRosterUser.LastName util/Seeder/Models/SeedModels.cs:97
- IndividualUserOptions.FirstName util/Seeder/Options/IndividualUserOptions.cs:13
- IndividualUserOptions.LastName util/Seeder/Options/IndividualUserOptions.cs:18
- Request.FirstName util/Seeder/Scenes/UserIdentityCipherScene.cs:23
- Request.LastName util/Seeder/Scenes/UserIdentityCipherScene.cs:25
- IndividualArgs.FirstName util/SeederUtility/Commands/IndividualArgs.cs:16
- IndividualArgs.LastName util/SeederUtility/Commands/IndividualArgs.cs:19
Phone — 23 field(s)
- OpenIdConnectScopes.Phone bitwarden_license/src/Sso/Utilities/OpenIdConnectScopes.cs:43
- ProviderEditModel.BillingPhone src/Admin/AdminConsole/Models/ProviderEditModel.cs:55
- CipherBankAccountModel.BankContactPhone src/Api/Vault/Models/CipherBankAccountModel.cs:62
- CipherIdentityModel.Phone src/Api/Vault/Models/CipherIdentityModel.cs:77
- Provider.BillingPhone src/Core/AdminConsole/Entities/Provider/Provider.cs:59
- Constants.BitwardenMobileSsoCallbackUris src/Core/Constants.cs:56
- FeatureFlagKeys.PM3503_MobileAnonAddySelfHostAlias src/Core/Constants.cs:221
- FeatureFlagKeys.PM3553_MobileSimpleLoginSelfHostAlias src/Core/Constants.cs:222
- FeatureFlagKeys.MobileErrorReporting src/Core/Constants.cs:223
- FeatureFlagKeys.CxpImportMobile src/Core/Constants.cs:226
- FeatureFlagKeys.CxpExportMobile src/Core/Constants.cs:227
- FeatureFlagKeys.MobileCardScanner src/Core/Constants.cs:230
- BitwardenClient.Mobile src/Core/Enums/BitwardenClient.cs:9
- PushNotification.NonMobileOnly src/Core/Platform/Push/PushNotification.cs:62
- DeviceTypes.MobileTypes src/Core/Utilities/DeviceTypes.cs:7
- CipherBankAccountData.BankContactPhone src/Core/Vault/Models/Data/CipherBankAccountData.cs:16
- CipherIdentityData.Phone src/Core/Vault/Models/Data/CipherIdentityData.cs:23
- IdentityViewDto.Phone util/Seeder/Models/CipherViewDto.cs:291
- BankAccountViewDto.BankContactPhone util/Seeder/Models/CipherViewDto.cs:370
- EncryptedIdentityDto.Phone util/Seeder/Models/EncryptedCipherDto.cs:230
- EncryptedBankAccountDto.BankContactPhone util/Seeder/Models/EncryptedCipherDto.cs:293
- SeedIdentity.Phone util/Seeder/Models/SeedModels.cs:67
- Request.Phone util/Seeder/Scenes/UserIdentityCipherScene.cs:32
Date of birth — 8 field(s)
- CipherDriversLicenseModel.DateOfBirth src/Api/Vault/Models/CipherDriversLicenseModel.cs:39
- CipherPassportModel.DateOfBirth src/Api/Vault/Models/CipherPassportModel.cs:37
- CipherDriversLicenseData.DateOfBirth src/Core/Vault/Models/Data/CipherDriversLicenseData.cs:10
- CipherPassportData.DateOfBirth src/Core/Vault/Models/Data/CipherPassportData.cs:9
- DriversLicenseViewDto.DateOfBirth util/Seeder/Models/CipherViewDto.cs:388
- PassportViewDto.DateOfBirth util/Seeder/Models/CipherViewDto.cs:424
- EncryptedDriversLicenseDto.DateOfBirth util/Seeder/Models/EncryptedCipherDto.cs:308
- EncryptedPassportDto.DateOfBirth util/Seeder/Models/EncryptedCipherDto.cs:341
Financial (card / IBAN) — 4 field(s)
- CipherBankAccountModel.Iban src/Api/Vault/Models/CipherBankAccountModel.cs:58
- CipherBankAccountData.Iban src/Core/Vault/Models/Data/CipherBankAccountData.cs:15
- BankAccountViewDto.Iban util/Seeder/Models/CipherViewDto.cs:367
- EncryptedBankAccountDto.Iban util/Seeder/Models/EncryptedCipherDto.cs:290