DEV Community

Cover image for title: The Three-Headed Bug That Almost Sank My Compliance App published: true tags: devchallenge, bugsmash
Ileana Mazilu
Ileana Mazilu

Posted on

title: The Three-Headed Bug That Almost Sank My Compliance App published: true tags: devchallenge, bugsmash

Summer Bug Smash: Smash Stories 🐛🛹

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry.

The Setup

I'm not a traditional developer. I spent 20 years as a pharmacy technician and medical writer before I taught myself to build software using AI-assisted, no-code tools. Earlier this year, I built MedAd Compliance AI—a tool powered by Google's Gemini API that reviews medical device documentation against EU MDR and ICH-GCP regulatory standards. I didn't write the code by hand; I built it through natural-language prompts in Lovable, describing what I needed in plain English and iterating until the app behaved. That doesn't mean the debugging disappeared—it just looked different than a typical engineer's day. Three bugs, back to back, almost took the whole project down before it ever reached a user.

You can see the live tool here: https://ileana-mazilu.lovable.app/medad-ai

Bug #1: The AI That Lied With Confidence

The review engine would sometimes generate compliance feedback that sounded completely authoritative—citing specific clauses or requirements—but the details didn't actually match real EU MDR or ICH-GCP language. It wasn't obviously wrong. It was confidently, fluently wrong, which is far more dangerous in a regulatory tool than an answer that's obviously broken.

As someone with 20 years of hands-on regulatory experience, I could catch this because I knew the real standards well enough to spot the mismatch. A user without that background wouldn't have known to question it.

What I did: I rewrote the underlying instructions given to the AI, adding explicit constraints forcing it to only reference verifiable regulatory language and to flag uncertainty instead of inventing specifics when it wasn't sure. I tested it repeatedly against documents where I already knew the correct compliance answer, comparing the AI's output against my own expert review until the confident-but-wrong pattern stopped showing up.

Bug #2: The PDF That Refused to Change

Every time I generated a new compliance report for a different document, the exported PDF looked suspiciously similar to the last one—even when the underlying analysis should have been completely different. I only caught it because I ran two clearly different test documents back to back and compared the outputs side by side; they were nearly identical, which should have been impossible.

What I did: I traced it back to the report template pulling from a cached or default data set instead of the fresh analysis each time. I had to rebuild the export step so it explicitly pulled the current session's results instead of falling back to old data, then re-tested with several different documents in a row to confirm each report was actually unique.

Bug #3: The Rewrite Feature That Broke Itself

The tool's rewriting function—meant to suggest corrected, compliant language for flawed document sections—would sometimes cut off mid-sentence or return incomplete text, especially on longer passages. It wasn't a crash; it was worse, because it looked finished when it wasn't, and a user could easily miss that the suggested rewrite was truncated.

What I did: I identified that longer inputs were hitting an output limit that silently cut the response short instead of erroring out. I adjusted how the tool handled longer passages, breaking them into smaller chunks the AI could process fully instead of trying to force one long response, then verified the fix by testing with the longest, most complex document sections I could find.

What I Learned

Building with AI tools doesn't mean the debugging disappears—it just changes shape. Instead of stepping through stack traces, I was stepping through prompts, outputs, and edge cases, trying to figure out not just what broke, but why an AI model would confidently produce something wrong. That's a different kind of debugging discipline, and it took my regulatory background—not a computer science background—to actually catch two of these three bugs in the first place.

What I'm proud of: none of these bugs were hypothetical. They stood between real users and a tool meant to help people navigate genuinely high-stakes regulatory work. Fixing them wasn't just a technical win—it was the difference between a tool I could stand behind and one I couldn't.

🔗 Try the tool: https://ileana-mazilu.lovable.app/medad-ai

Top comments (0)