External review pass (2026-07-17) covering security, correctness, and project hygiene across the codebase. Findings below, verbatim from the review:
- Dashboard PHI leak:
DashboardAPIViewwas reachable anonymously, exposing claim/patient counts and revenue figures without authentication.
- Prompt injection — write target:
update_claim_ai_resultaccepted a model-suppliedclaim_id, allowing adversarial claim-note content to potentially redirect writes to a different Claim.
- setup_ai.sh hardcoded paths: the script assumed a fixed checkout location rather than deriving paths relative to itself, breaking portability across machines/checkouts.
- No root README: the project had no top-level README explaining what it is, how to run it, or what makes it technically interesting.
- Chain denial agents: suggested chaining
appeal-drafterafterdenial-analyzerso the appeal could reference the denial's findings.
- Race between denial agents: both denial-path agents could write to the same Claim concurrently with no protection against a stale write clobbering a newer one.
- Dev credential comments: hardcoded demo credentials in scripts/settings lacked any comment clarifying they are dev-only, never production values.
- Financial integrity checks: no validation that claim/invoice line-item totals, payment amounts, and invoice balances stayed internally consistent.
- Workflow gaps (appeal/reopen): some claim lifecycle transitions (e.g. reopening a denied claim) were missing or incompletely wired.
- Denial rate denominator: the dashboard's denial-rate calculation used a denominator that didn't match the intended definition of the metric.
- Known limitations section: the README (once it existed) needed an honest, specific accounting of what's out of scope and why, not a generic disclaimer.
- Frontend cleanup: unused Tailwind CSS tooling remained in the frontend after the actual styling approach moved to inline style objects.
- Committed bundle: a built frontend JS bundle was checked into git rather than generated at build/deploy time.
| Feedback | Decision | Ticket |
|---|---|---|
| Dashboard PHI leak | Accepted and fixed | PAT-30 (Done) |
| Prompt injection — write target | Accepted and fixed | PAT-31 (Done) |
| setup_ai.sh hardcoded paths | Accepted | PAT-32 |
| No root README | Accepted | PAT-34 |
| Chain denial agents | Rejected — violates ADR-001; agents are logically independent | — |
| Race between denial agents | Accepted — fixed via atomic field updates, not chaining | PAT-39 |
| Dev credential comments | Accepted | PAT-29 |
| Financial integrity checks | Accepted at take-home scope | PAT-43 |
| Workflow gaps (appeal/reopen) | Accepted | PAT-42 |
| Denial rate denominator | Accepted | PAT-42 |
| Known limitations section | Accepted | PAT-34 |
| Frontend cleanup | Accepted | PAT-35 |
| Committed bundle | Accepted | PAT-35 |