3 Bugs I Fixed Before Shipping My WhatsApp AI Receptionist

Full-stack developer Sajib fixed three bugs in the knowledge pipeline (CSV/PDF/URL → chunks → Postgres) of a WhatsApp AI receptionist before shipping it in v0.5.0. The bugs included a deduplication flaw that silently discarded unchanged chunks and deleted them when the old version was replaced, a check-then-act race letting two workers claim the same pending source, and a URL-fetch vulnerability exposing localhost, internal services, and cloud metadata via redirects. The fixes—transactional version replacement, atomic claim via a conditional UPDATE with RETURNING, and URL-fetch safeguards capping responses at 5 MB—shipped with 30 tests using Node's built-in test runner.

My WhatsApp AI receptionist answered pricing questions, booked appointments, and handed off to a human. The demo worked. Then a production review exposed three bugs in its knowledge pipeline: CSV/PDF/URL → chunks → Postgres. Deduplication compared incoming chunks against the previous version. Unchanged chunks were discarded as duplicates—then deleted when the old version was replaced. A 10% update left just 10% of the knowledge. No error. Just missing answers. Fix: Identify the previous version before deduping, exclude its chunks from the comparison, and replace it in one transaction. Add a regression test. A SELECT followed by an UPDATE let two workers pick the same pending source. Fix: Claim it atomically: UPDATE knowledge sources SET status = 'processing' WHERE id = $1 AND status = 'pending' RETURNING ; No returned row means no claim. That worker skips ingestion. A submitted URL could send the server to localhost, internal services, or cloud metadata—including through redirects. Fix: Add URL-fetch safeguards: allow HTTP S only, check resolved IPs for internal destinations, revalidate every redirect, and cap responses at 5 MB. These fixes shipped in v0.5.0 , with 30 tests using Node’s built-in runner. A working conversation is only part of the test. Re-uploads, competing workers, and untrusted URLs deserve their own. Which of these has caught you before? My bet: the check-then-act race. — Sajib, full-stack developer from Dhaka · sajib.dev.cv https://sajib.dev.cv