My WhatsApp AI receptionist answered pricing questions, booked appointments, and handed off to a human.
The demo worked. Then a production review exposed three bugs in its knowledge pipeline: CSV/PDF/URL → chunks → Postgres.
1. Re-uploading erased unchanged facts
Deduplication compared incoming chunks against the previous version. Unchanged chunks were discarded as duplicates—then deleted when the old version was replaced.
A 10% update left just 10% of the knowledge. No error. Just missing answers.
Fix: Identify the previous version before deduping, exclude its chunks from the comparison, and replace it in one transaction. Add a regression test.
2. Two workers could claim the same job
A SELECT followed by an UPDATE let two workers pick the same pending source.
Fix: Claim it atomically:
UPDATE knowledge_sources
SET status = 'processing'
WHERE id = $1
AND status = 'pending'
RETURNING *;
No returned row means no claim. That worker skips ingestion.
3. Website imports opened an SSRF path
A submitted URL could send the server to localhost, internal services, or cloud metadata—including through redirects.
Fix: Add URL-fetch safeguards: allow HTTP(S) only, check resolved IPs for internal destinations, revalidate every redirect, and cap responses at 5 MB.
The lesson
These fixes shipped in v0.5.0, with 30 tests using Node’s built-in runner.
A working conversation is only part of the test. Re-uploads, competing workers, and untrusted URLs deserve their own.
Which of these has caught you before? My bet: the check-then-act race.
— Sajib, full-stack developer from Dhaka · sajib.dev.cv
Top comments (1)
The SSRF one scared me most. Curious how others handle redirect re-validation.