RDP Web module

[bpmct]

A discussion dedicated to the RDP Web module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
11 / 17	8 / 20	0 / 20	7 / 10	39 / 100

Drilldown

Track: Utility (RDP/remote-desktop access module; not an AI agent or code-editor IDE)

Presentation & Onboarding — 11 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README has AWS, GCP, custom-version, and native-RDP example blocks, but AWS/GCP/native-RDP examples are textually identical (no provider-specific differences shown) and the documented enable_native_rdp = false (web-only) mode is only described in prose, never shown as its own code example. Major mode switch (web-only vs native) is under-documented.
Visual preview	5	5	README embeds a linked thumbnail image (video-thumbnail.png, verified to exist) pointing to a demo video — satisfies the criterion.

Credential Hygiene — 8 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	admin_password is marked sensitive = true and README examples don't show inline password values, but the module ships a hardcoded, publicly-visible default password ("coderRDP!") baked into the variable default, which is a real exposed credential despite the sensitive flag — capped at half.
Non-hardcoded auth path	4	0	No alternative to raw username/password RDP auth (no IAM/OAuth/SSO/API-key-helper path) documented.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	devolutions_gateway_version only pins a version string used with Install-Module/Install-PackageProvider against PSGallery/NuGet; no variable overrides the actual download/install URL.
Bring-your-own binary	10	0	No documented variable or flag to skip installing Devolutions Gateway when it's already baked into the image.
Egress transparency	3	0	No dedicated README section enumerating external endpoints (PSGallery, NuGet, etc.) contacted during install/runtime.
Runs without sudo	2	0	PowerShell script performs Set-LocalUser, registry edits under HKLM, firewall rule changes, and Windows service start/installs — all require Administrator-equivalent elevated privileges for core functionality, with no documented non-elevated fallback.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	Most variables (share, agent_name, enable_native_rdp, tooltip, devolutions_gateway_version) have descriptions and some validation, but admin_username and admin_password lack descriptions entirely.
Test coverage	4	4	.tftest.hcl covers business logic (native RDP app creation/omission, agent_name validation, URL construction) and main.test.ts verifies generated script content (install script, credential injection, special-character handling) — solid dual coverage.

Overall — 39 / 100

Raw 26 / 67 → round(26 / 67 × 100) = 39

---

Scored against SCORECARD.md on 2026-10-05 with solstice-1.