A legacy multi-tenant healthcare enterprise system running WCF services on .NET Framework 4.8 was flagged during a Veracode dynamic application security testing (DAST) audit for high-severity stored Cross-Site Scripting (XSS) vulnerabilities.
Malicious script payloads injected into participant claim notes and provider descriptions were stored unescaped in SQL Server and reflected directly in JSON API responses without HTML sanitization, allowing arbitrary script execution in client browsers.
Engineered a centralized, low-risk remediation layer inside the WCF pipeline. Authored a custom `JsonMediaTypeFormatter` subclass that configures Newtonsoft.Json's `StringEscapeHandling.EscapeHtml` during response serialization. Injected this formatter via a custom `IDispatchMessageInspector` and `IEndpointBehavior`, safely escaping all HTML-sensitive characters (`<`, `>`, `&`, `'`, `"`) in JSON output while preserving raw data integrity in the database. Deployed behind configurable feature flags to enable instant zero-downtime rollback.
Remediated high-severity stored XSS across 4 core WCF enterprise services, passing all subsequent Veracode DAST and penetration testing re-scans with zero regressions in downstream client apps.