OWASP Foundation

Node.js Support Triage: Rerank PDF Pages, Summarize with Embeddings

A technical how-to on building B2B support triage using embeddings and LLM summarization in Node.js. The author recommends separating PDF retrieval from answer generation, preserving page identity, and using a two-pass pipeline (embedding search → rerank → structured summarization) as the practical default. The article includes a TypeScript orchestration example with explicit types and failure policies, suggested runtime configuration (retrieve 18 candidates, keep 6, per-stage deadlines), testing guidance, and threat-modeling advice referencing OWASP guidance and GDPR principles. It also describes fallback options: a low-latency embedding-only path and deterministic issue-to-page rules for high-consequence queues.

Swap-ready multilingual invoice and ticket summarization

Technical guidance for building a portable, swap-ready summarization step that uses a chat completions API behind an internal interface to extract structured fields and two-sentence English summaries from multilingual supplier invoices, email threads, support tickets and meeting notes. The article emphasizes storing the normalized input text to enable backfills and reruns, treating residency and retention (especially for EU/US data) as routing decisions you control, and implementing operational controls such as a 200-thread golden set, daily drift checks, idempotent requests, and clear rollback procedures. It compares vendor options (OpenAI, Anthropic, Amazon Bedrock, OpenRouter, Infrai, self-hosting) and highlights security and operational precautions (OWASP guidance, never let extracted values trigger payments without a human).

Avoid Storing Full Magic Links in Audit Logs

The article warns that passwordless 'magic link' authentication tokens must be treated like credentials to avoid accidental leakage through logs, traces, support dashboards, and test artifacts. It recommends redacting full verification URLs and raw tokens from observability and support systems while preserving useful audit metadata (attempt id, subject id, channel, redacted destination hint, timestamps, provider message id, and result). The author suggests pairing redacted audit events with idempotent verification handling, implementing a single auth-event formatter, blocking sensitive fields from structured logs, adding tests to detect leaks, and reviewing downstream sinks such as tracing and alert systems.