# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 53 → 54 (+1.3)
- Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

## Lenses

- Code Health 82 → 87 (+5.3)
- Architecture 74 → 73 (-0.3)
- Maturity 65 → 69 (+3.7)
- Readiness 32 → 32 (+0.8)
- Security 76 → 77 (+1.5)
- Domain Modelling 100 → 100 (+0.0)
- Event-Driven 100 → 100 (+0.0)
- Accessibility 72 → 71 (-0.3)
- Performance 72 → 72 (+0.0)

## Resolved (16)

- Coverage not measured — test suite did not build
- Duplicated block (13–19 lines × 2) (src/AppointMe.Api/Authentication/EntraExternalId/EntraExternalIdClaimsTransformer.cs)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Medium CVE: [GHSA redacted] (src/AppointMe.Frontend/package-lock.json)
- Medium CVE: [GHSA redacted] (src/AppointMe.Frontend/package-lock.json)
- Medium CVE: [GHSA redacted] (src/AppointMe.Frontend/package-lock.json)

## New (26)

- Coverage not measured — test suite did not build
- Duplicated block (13 lines × 2) (src/AppointMe.Api/Authentication/EntraExternalId/EntraExternalIdClaimsTransformer.cs)
- High CVE: [GHSA redacted] (src/AppointMe.Frontend/package-lock.json)
- High CVE: [GHSA redacted] (src/AppointMe.Frontend/package-lock.json)
- High CVE: [GHSA redacted] (src/AppointMe.Frontend/package-lock.json)
- High CVE: [GHSA redacted] (src/AppointMe.Frontend/package-lock.json)
- High CVE: System.Security.Cryptography.Xml 10.0.7
- High CVE: System.Security.Cryptography.Xml 10.0.7
- High CVE: System.Security.Cryptography.Xml 10.0.7
- High CVE: System.Security.Cryptography.Xml 10.0.7
- High CVE: System.Security.Cryptography.Xml 10.0.7
- High vulnerability: [GHSA redacted] (src/AppointMe.Frontend/package-lock.json)
- High vulnerability: [GHSA redacted] (src/AppointMe.Frontend/package-lock.json)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- High: security finding (details withheld)
- …and 6 more

## Changes since last survey

- 10 commits — 7 feature/other, 3 fixes

## By area

- src/AppointMe.Api — 4 commits
- docs/CODE_REVIEW_REPORT.md — 2 commits
- src/AppointMe.Frontend — 2 commits
- src/Booking — 1 commit
- src/Organizations — 1 commit

## Notable commits

- fix: Fix potential SqlConnection leak when OpenAsync throws
- fix: Fixed `RequireHttpsMetadata` insecure default
- fix: Slight consistency fix in the current user context. Made it null initially.
- change: Add CSRF protection
- change: Add security response headers middleware
- change: B1 and B2 - Constrain assignable roles
- change: Configure HSTS
- change: H3 — `ReconcileServiceProviders` silently drops all remaining updates/deletes after the first failed record (data loss)
- change: L3 — Logout is an anonymous GET (logout CSRF)
- change: session lifetime is now an explicit instead of the implicit framework default — ExpireTimeSpan = 7 days with SlidingExpiration = true.

## API surface

- 1 added · 1 removed (a removed endpoint is potentially breaking)

## Added endpoints (1)

- POST /logout

## Removed endpoints (breaking) (1)

- GET /logout