---
id: change/bcapps/9360
type: change
title: "#9360 Harden SFTP Client module (security review phase 1)"
summary: The SFTP Client module hardens security by removing MD5 fingerprint support, adding a 25 MB file-size limit, disabling debugging, and applying NonDebuggable attributes to sensitive code paths. The SFTP Connector now only accepts SHA256 fingerprints.
tier: official
language: en
tags:
  - fix
  - main
  - bc30
  - table ext. sftp account
  - codeunit ext. sftp connector impl
  - codeunit dotnet sftp client
  - interface isftp client
  - codeunit sftp client
  - codeunit sftp client implementation
system: development
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:09:24.094Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: 636f3106cffe75da027d6f3fad0de30108c50c65
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/9360
    title: "microsoft/BCApps#9360: Harden SFTP Client module (security review phase 1)"
    date: "2026-08-12"
    commit: 636f3106cffe75da027d6f3fad0de30108c50c65
    t: null
    quote: Remove MD5 host-key fingerprint support end-to-end.
links:
  learn: []
  objects:
    - object/table/4621
    - object/codeunit/4621
    - object/codeunit/9760
    - object/interface/isftp-client
    - object/codeunit/9762
    - object/codeunit/9763
    - object/enum/9760
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 9360
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/9360
kind: pr
base_branch: main
major: "30"
merged_at: "2026-08-12T09:17:54Z"
author: JesperSchulz
author_type: User
community_contribution: false
labels:
  - "AL: Apps (W1)"
  - "AL: System Application"
  - "Team: Integrations"
change_class: code
change_kind: fix
behavior_change: true
breaking: true
files:
  count: 10
  additions: 153
  deletions: 38
  al: 7
apps:
  - External File Storage - SFTP Connector
  - System Application
objects_touched:
  - key: table/4621
    page: table/4621
    type: table
    id: 4621
    name: Ext. SFTP Account
    app: External File Storage - SFTP Connector
    status: modified
  - key: codeunit/4621
    page: codeunit/4621
    type: codeunit
    id: 4621
    name: Ext. SFTP Connector Impl
    app: External File Storage - SFTP Connector
    status: modified
  - key: codeunit/9760
    page: codeunit/9760
    type: codeunit
    id: 9760
    name: Dotnet SFTP Client
    app: System Application
    status: modified
  - key: interface/isftp client
    page: interface/isftp-client
    type: interface
    id: null
    name: ISFTP Client
    app: System Application
    status: modified
  - key: codeunit/9762
    page: codeunit/9762
    type: codeunit
    id: 9762
    name: SFTP Client
    app: System Application
    status: modified
  - key: codeunit/9763
    page: codeunit/9763
    type: codeunit
    id: 9763
    name: SFTP Client Implementation
    app: System Application
    status: modified
  - key: enum/9760
    page: enum/9760
    type: enum
    id: 9760
    name: SFTP Exception Type
    app: System Application
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 632215
systems:
  - development
quote: Remove MD5 host-key fingerprint support end-to-end.
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #9360 Harden SFTP Client module (security review phase 1)

> The SFTP Client module hardens security by removing MD5 fingerprint support, adding a 25 MB file-size limit, disabling debugging, and applying NonDebuggable attributes to sensitive code paths. The SFTP Connector now only accepts SHA256 fingerprints.

[Pull request](https://github.com/microsoft/BCApps/pull/9360) · merged into `main` (BC30) on 2026-08-12 by JesperSchulz · 10 files (+153 -38), 7 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- MD5 host-key fingerprints are no longer supported; only SHA256 prefixes accepted
- File upload and download operations are capped at 25 MB with a typed File Too Large exception
- Debugging is disabled and sensitive code paths marked NonDebuggable to protect customer data
- Generic exception branch no longer exposes raw server or .NET exception text
- Telemetry event SFTP-0001 added to track file transfer sizes
- Breaking: existing extensions can stop compiling or working.

## AL objects touched

- [Table 4621 "Ext. SFTP Account"](../../objects/table/4621.md), External File Storage - SFTP Connector: modified
- [Codeunit 4621 "Ext. SFTP Connector Impl"](../../objects/codeunit/4621.md), External File Storage - SFTP Connector: modified
- [Codeunit 9760 "Dotnet SFTP Client"](../../objects/codeunit/9760.md), System Application: modified
- [Interface "ISFTP Client"](../../objects/interface/isftp-client.md), System Application: modified
- [Codeunit 9762 "SFTP Client"](../../objects/codeunit/9762.md), System Application: modified
- [Codeunit 9763 "SFTP Client Implementation"](../../objects/codeunit/9763.md), System Application: modified
- [Enum 9760 "SFTP Exception Type"](../../objects/enum/9760.md), System Application: modified

## Context

- Work items: AB#632215
- Labels: AL: Apps (W1), AL: System Application, Team: Integrations
- Systems: development
- From the description: "Remove MD5 host-key fingerprint support end-to-end."

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).