Artek engineering team · October 2026
Security
- 23 web endpoints answered without a login. Web Dev endpoints are easy to add for one integration and easy to forget. Each one should require authentication or be removed.
- 3 named queries pasted parameters into the SQL as raw text. That is the pattern behind SQL injection. Typed parameters fix it.
- 2 hard-coded IP addresses in project code, which break silently when a server moves.
Reliability
- 71 error handlers hid failures instead of logging them. A script that fails silently looks the same as one that works until someone checks the data.
- A restore without two third-party modules broke 21 component instances. The backup restored cleanly, and the screens did not.
- Two alarm-count headers called a function in a form known to fail.
- The gateway was two patch releases behind, and 31 named queries were still stored in the older 8.1 format.
Performance
- One named query read a whole table with no limit, which gets slower as the table grows.
- Three bindings re-ran every one to two seconds, putting constant load on the gateway and the database.
- One view held 436 components, which is slow to open on a tablet.
Clutter
- 539 of 888 views were not reachable from any page, dock or script.
- 12 of 66 named queries and 24 library functions had no caller.
Clutter is not urgent on its own, but every unused view and query is something the next engineer has to read before changing anything.
How the report is built
Each finding states what we found, where, what could happen because of it, and how much effort the fix takes, from a quick fix to a project. A senior engineer reads every report before it is sent, and the report says plainly what the scan cannot see: the PLCs, the database contents and how people use the system.
Read the full sample report (PDF), or send us a backup of your own gateway for a free one.
