Repository navigation
Privacy: check every search box for patient details before text leaves the page (S1) - #3834
Merged
Merged
Conversation
…s and guideline dates Privacy audit PD-01 and PD-02 (2026-10-26). The Clinical question check now reads given names beyond the English list, a listed surname on either side (surname-first names too), a surname then a given name, 'Jane T.', 'Jane (Surname)', a possessive given name, Prof and Sr titles, and a lower-case title with one letter. 1300 and 1800 service numbers and dates a guideline, policy or protocol carries are set aside before the phone and date checks. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EyULT41weiAuu3CroGX7oD
Privacy audit S1 (2026-10-26): - D26-01, CA-02, CA-05: Medication and differentials typing-pause fetches await the patient-detail check first, so a name never reaches our server. - CA-01: suggested, recent and cross-mode Medication searches and the Services, Forms and Favourites chips run the check before navigating. - CA-03: Tools, launcher, Calculators, On Call Refer link, Dictionary menu and the Dictionary topic box leave a patient detail out of ?q=. - CA-04: the search guard fails closed while the full check loads or when it cannot load. - CA-05: shared links with a patient detail in ?q= are cleaned on arrival on every search page. - CA-06: Referrer-Policy strict-origin. - CA-08: safety plan and My Day note fields opt out of autofill, spelling and grammar extensions. - Synthetic corpus floors for the widened name check. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EyULT41weiAuu3CroGX7oD
The search guard now fails closed until the full check has loaded, so tests that expect a search to go out load it first. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EyULT41weiAuu3CroGX7oD
The guard fails closed until the check has loaded, so loading it on mount keeps a quick Enter from being held back as unchecked. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EyULT41weiAuu3CroGX7oD
Contributor
|
Warning Review limit reachedYour organization has reached its usage spending cap. Adjust your spending cap in the billing tab. Next included review available in 49 minutes. View limit details
Comment |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
Contributor
…s sent (CA-02) Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EyULT41weiAuu3CroGX7oD
7 of 8 tasks
BigSimmo
marked this pull request as ready for review
October 26, 2026 09:33
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Claude encountered an error after 2s —— View job I'll analyze this and get back to you. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 173f9da613
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… (review on #3834) Service-number digits are replaced by a word instead of removed, so the same digits as an MRN or inside an email are still caught. Document dates now need a document word, and a patient word between blocks the exemption. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EyULT41weiAuu3CroGX7oD
1 task done
9 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Josh · project thread
Summary
Stream S1 of the 26 Oct plan (privacy audit, 2026-10-26). Josh asked for it to be completed and taken out of draft on 26 Oct. Ordinary code: no database, no paid calls, no protected search files.
Patient-detail check (PD-01, PD-02) in
src/lib/clinical-question-bare-name.tsandsrc/lib/clinical-question-patient-check.ts, used by Answer, Clinical Ask, feedback notes and every search box:Synthetic corpus, before and after (the audit's corpus plus a held-out set written before any change, both now in
tests/fixtures/patient-detail-corpus.tswith floors intests/patient-detail-corpus.test.ts):Still missed (needs a decision, not more lists): a surname typed alone ("Can Testpatient have ECT", 10 cases), given names not on the list, quasi-identifiers ("the 92 year old from Wiluna"), DVA, CRN and passport numbers, PO boxes, "@handle". The audit corpus was used while tuning, so the held-out numbers are the fairer guide; the held-out set was also written by the same author.
Search boxes
/api/medicationsor/api/differentials, including a deep link's first request. The held-back sentence shows instead; differentials shows "This search was not sent" with no Retry.DocumentViewer.tsx) awaits the check before calling/api/documents/<id>/search, and shows the held-back sentence on the search's error line. This does not touch fix(a11y): announce document viewer offline state #3804's Offline badge hunk.setMedicationSearchQuery) and the Medication, Services, Forms and Favourites chips run the check before writing the address, history or recent searches. Chips are not hidden (that would be a design change).?q=.?q=holds a patient detail is cleaned on arrival on every search page, not only the dashboard.Headers and fields
Referrer-Policy: strict-origin(wasstrict-origin-when-cross-origin). CSRF and the local-project guard read only the host, so they are unaffected.Already fixed on main, verified: the whole-codebase and security-test rows "Bare first-and-last names (and street addresses) pass the clinical-question patient check" (owner decision 25 Oct,
bareNameOrAddressProblem).Not in this PR
src/lib/deep-memory.ts): protected search file, needs a RAG impact line and canary, left for W1/W3.Overlap: #3836 also edits
ClinicalDashboard.tsx,use-dashboard-search-execution.ts,use-medication-catalog.tsandpatient-safety-plan.tsx. Whichever lands second will need a sync.Areas touched: App experience, Answer engine, Data platform and access, Personal practice (plus 2 files not yet placed in any area)
RAG impact: no retrieval behaviour change. No file in
ragRankingPatternsis touched; the check only decides whether a question is sent.Verification
npm run test) on c9261d9 plus the fixes:Test Files 2 failed | 2096 passed | 2 skipped,Tests 4 failed | 33574 passed. The 4 failures are environmental:tests/cloud-platform-smoke.test.ts(3) andtests/rag-plan-package-parity.test.ts(1), "npm 11.17.0 is required; detected 11.19.1" in this container.Test Files 27 passed,Tests 356 passed. Typecheck and lint clean.tests/clinical-question-patient-check.test.ts(139 passed, including the 20 high-risk evaluation questions and every retrieval golden query),tests/patient-detail-corpus.test.ts,tests/search-box-patient-detail.dom.test.tsx(17),tests/search-patient-detail-guard.test.ts,tests/security-headers.test.ts.verify:ui). Hosted CI runs them now that the PR is ready.Risk and rollout
Clinical Governance Preflight
PsychSift Production(sjrfecxgysukkwxsowpy)Evidence / not applicable / unresolved:
🤖 Generated with Claude Code
https://claude.ai/code/session_01EyULT41weiAuu3CroGX7oD