# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 36 → 38 (+2.4)
- Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

## Lenses

- Code Health 83 → 84 (+1.0)
- Architecture 92 → 92 (+0.0)
- Maturity 46 → 53 (+6.6)
- Readiness 42 → 42 (+0.0)
- Security 16 → 19 (+2.8)

## Resolved (7)

- Change coupling: EnableEmailAuthenticatorCommand.cs ↔ EnableOtpAuthenticatorCommand.cs (src/starterProject/Application/Features/Auth/Commands/EnableEmailAuthenticator/EnableEmailAuthenticatorCommand.cs)
- High: security finding (details withheld)
- High: security finding (details withheld)
- Inconsistent naming for response DTOs. Some use 'Response' suffix (e.g., CreatedUserResponse), while others use 'Response' as well. However, 'UpdatedUserFromAuthResponse' is used for an update operation, which is inconsistent with 'CreatedUserResponse' and 'DeletedUserResponse'. Typically, update operations might use 'UpdatedUserResponse' or 'UserUpdatedResponse'.
- Inconsistent naming for the User entity's command/query classes. Some use the singular 'User' (e.g., CreateUserCommand), while others use the plural 'Users' in the namespace path (e.g., Application.Features.Users...), but the command/query names themselves are consistent. However, looking at the broader codebase, there is a mix of singular and plural in feature names: 'UserOperationClaims' vs 'OperationClaims'.
- Rotate the exposed credentials — git history can't be un-committed
- The term 'UserOperationClaim' is used for the many-to-many link table/entity. However, 'OperationClaim' is used for the base claim entity. The naming 'UserOperationClaim' is descriptive but inconsistent with the pattern of 'User' + 'OperationClaim'. It might be clearer to name it 'UserClaim' or 'UserOperationClaim' consistently. More importantly, there is a mix of 'User' and 'Users' in the namespace paths: 'Application.Features.Users' vs 'Application.Features.UserOperationClaims'.

## New (3)

- High: security finding (details withheld)
- High: security finding (details withheld)
- Workflow token permissions not restricted

## API surface

- Unchanged — 25 HTTP endpoints

## Architecture

- Unchanged — 3 containers · 1 contexts · 0 edges