3 Bugs I Fixed Before Shipping My WhatsApp AI Receptionist

My WhatsApp AI receptionist answered pricing questions, booked appointments, and handed off to a human.

The demo worked. Then a production review exposed three bugs in its knowledge pipeline: CSV/PDF/URL → chunks → Postgres.

Deduplication compared incoming chunks against the previous version. Unchanged chunks were discarded as duplicates—then deleted when the old version was replaced.

A 10% update left just 10% of the knowledge. No error. Just missing answers.

Fix: Identify the previous version before deduping, exclude its chunks from the comparison, and replace it in one transaction. Add a regression test.

A SELECT followed by an UPDATE let two workers pick the same pending source.

UPDATE knowledge_sources SET status = 'processing' WHERE id = $ 1 AND status = 'pending' RETURNING *; Enter fullscreen mode Exit fullscreen mode No returned row means no claim. That worker skips ingestion.

A submitted URL could send the server to localhost, internal services, or cloud metadata—including through redirects.

Fix: Add URL-fetch safeguards: allow HTTP(S) only, check resolved IPs for internal destinations, revalidate every redirect, and cap responses at 5 MB.

These fixes shipped in v0.5.0, with 30 tests using Node’s built-in runner.

A working conversation is only part of the test. Re-uploads, competing workers, and untrusted URLs deserve their own.

Which of these has caught you before? My bet: the check-then-act race.

— Sajib, full-stack developer from Dhaka · sajib.dev.cv

Expand Mohamed Sajib Mohamed Sajib Mohamed Sajib Follow Full-stack developer & SEO systems engineer. I build production-focused enterprise platforms, AI products and CRM/ERP systems that turn real operational workflows into reliable software. Joined Oct 20, 2026 • Oct 20 Dropdown menu Copy link Hide The SSRF one scared me most. Curious how others handle redirect re-validation.