Fix critical security and clinical safety issues#39
Merged
Conversation
…fety - Fixed dependency vulnerabilities (npm audit fix) - Hardened numeric verification regex and clinical safety logic - Increased default token limits to 4000 to prevent clinical truncation - Verified Supabase service role usage security
BigSimmo
added a commit
that referenced
this pull request
Jun 19, 2026
…rged #38 (#41) Re-applies the 6 blocking clinical-safety fixes (B1-B6) on top of current main. PR #38 merged 22 RAG fixes before these blockers landed, and #39/#40 did not address them, so main still trusts wrong doses. - B1: numeric verification now matches by exact normalized token-set membership instead of substring, so "2.5 mg" no longer verifies against "12.5 mg" (5x dose error). Fails closed. - B2: fold unicode superscripts (×10⁹/L) to ASCII before extraction/match. - B3: percentage branch no longer ends in \b (which could never match), so percentages extract and percentage mismatches are flagged. - B4: numeric gate now scans answerSections[].body (medication_dose), scoped to each section's citation_chunk_ids. - B5: safeFallbackAnswer fails closed on parse failure (ungrounded, no citation back-fill) and still runs the numeric gate; extractive recovery and strong-retry routing updated accordingly. - B6: retry route reset is a single conditional UPDATE guarded on status/locked_at; 0 rows affected => 409, closing the TOCTOU race. - N1: verifyAnswerNumbers fails closed when no cited chunk maps to a result. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR resolves several critical issues identified in the repository: