# Comprehensive Analysis - MVC-Starter

**Date:** 2026-03-11T11:59:39Z

## Configuration Management

- Primary runtime configuration lives in `public/web.config`.
- Important settings include database connection, environment mode, flash timing, 404 redirect timing, cache controls, and error logging paths.
- Configuration is read in application code through helper accessors such as `GetAppSetting`.

## Authentication and Security

- No full authentication subsystem is present in the starter.
- The main observable security boundary is controller/action validation and controller whitelisting in `core/lib.ControllerRegistry.asp`.
- Dispatch also HTML-encodes some user-visible error output to reduce injection risk.

## Entry Points and Bootstrap

- IIS web root: `public/`
- Default document: `public/Default.asp`
- Runtime bootstrap include: `core/autoload_core.asp`
- Request dispatcher: `core/mvc.asp`

## Shared Code

- `core/` contains reusable framework/runtime libraries for routing, data access, flash messaging, forms, uploads, HTML helpers, validation, encryption helpers, and JSON support.
- `scripts/` contains operational generators and migration tooling.

## Event/Async Patterns

- No queue, worker, or event-bus architecture was detected.
- UI behavior is mostly server-rendered with small inline browser-side scripts where needed.

## CI/CD and Deployment

- No CI/CD pipeline configuration was detected.
- Deployment is IIS-based and documented in `README.md` and `public/web.config`.

## Localization

- No localization or i18n framework was detected.

## Testing Surface

- No automated test framework or test files were detected in the application code.
- Validation currently depends on manual runtime checks and script execution in a Windows/IIS environment.