Totals
258 findings · 8 high · 159 medium · 91 low.
Sample excerpt: from findings to a decided plan
AI-Accelerated X++ Codebase Audit
You buy a decided plan, not a findings PDF: a decision sheet (every finding verdicted fix now / fix at upgrade / deliberately accept), the CI gate installed in your Azure DevOps pipeline, and a decision meeting where your team agrees the sequenced program.
Bluewizarding Consulting LLC · Shawn Lenker, 11 years in Dynamics AX and D365 F&O codebases, most recently Senior D365 Developer at Patagonia. Target: a 3-package, 20-model customization layer (454 elements, 1,738 methods). Turnaround: under one day (manual reviews scope this at 2+ weeks).
Three of the report's twelve sections, run against a real, publicly licensed X++ codebase (TrudAX XppTools, MIT). Client reports follow the identical method under NDA.
Section 1
Executive heatmap
Red cells are where remediation budget should go first.
| Model (top 8 of 20 by risk) | Raw SQL | Legacy patterns | Localization debt | Security / I/O surface | Overlayering |
|---|---|---|---|---|---|
| DEVExternalIntegration | 5 | 23 | 46 | 29 | 0 |
| DEVExternalIntegrationSamples | 9 | 2 | 28 | 6 | 0 |
| DEVSQLExecute | 5 | 3 | 2 | 3 | 0 |
| DEVSQLReports | 2 | 4 | 0 | 3 | 0 |
| DEVDocuExpImp | 0 | 7 | 8 | 3 | 0 |
| DEVCommon | 0 | 3 | 9 | 9 | 0 |
| DEVTutorial | 1 | 7 | 7 | 2 | 0 |
| DEVCallStackInfolog | 2 | 2 | 1 | 0 | 0 |
Cell = finding count; color = worst severity. Full 20 x 6 matrix in the complete report.
Headline positive
Zero overlayering, zero name collisions against stock. All 454 elements are net-new (428) or proper extensions (26).
Section 2
Findings detail (sample: 3 of 258)
Raw SQL update path bypasses the kernel
- Where
DEVSQLQueryExecute.doExecuteUpdate (model DEVSQLExecute)- What / why
- Executes caller-supplied SQL directly against the database, bypassing X++ record-level security, database logging, and change tracking.
- Verdict: FIX NOW.
- Confine to a locked-down admin role; use SysDa for business logic. Effort: 2-3 days.
29 classes on RunBase/RunBaseBatch lineage
- Where
e.g. DEVLicenseReportCalc, 28 others (Appendix B).- What / why
- Legacy batch framework; Microsoft's investment targets SysOperation, so each class is a small upgrade tax that compounds.
- Verdict: FIX AT UPGRADE.
- Migrate opportunistically, not as a project. Effort: about half a day per class.
109 hardcoded English error literals
- Where
e.g. DEV.getColumnIdByName: throw error("Header should be read").- What / why
- Blocks localization entirely; the largest single debt bucket in the layer.
- Verdict: FIX NOW (mechanized).
- Our tooling generates the label file and substitution diff automatically. Effort: 1-2 days.
Section 3
The Remediation Program (excerpt)
| Phase | Scope | Risk retired | Indicative effort |
|---|---|---|---|
| 1. Contain | 8 high raw-SQL findings + privilege audit | Security, data integrity | 2-3 days |
| 2. Modernize | Top 10 RunBase migrations | Upgrade tax, batch reliability | 5-8 days |
| 3. Mechanize | Label extraction across 109 literals | Localization, UX consistency | 1-2 days |
| 4. Guard | Audit rule set installed as a CI gate | Regression of all the above | 1 day |
Phase 4 is the differentiator: the rule set that produced this audit is installed in YOUR pipeline as a CI gate, tuned to the accepted-risk decisions from the decision meeting.
Provenance
No finding is AI-generated.
Every finding comes from a deterministic AST scan by an open-source rule set, cited to an exact element, method, and source line; re-run the scan and you get identical numbers. The rule set is published at github.com/BlueWizarding/xpp-debt-scan: run it on your own code before you spend a dollar. What you pay for is the judgment layer: the verdicts, the sequencing, and the gate.