Spaces:

---

gaurv007

/

ClauseGuard

like 0

Running

ClauseGuard v4.1 — Comprehensive Bug Fix & Performance PR

🔴 CRITICAL Bug Fixes

1. XSS sanitization corrupting contract text — Removed text.replace(/</, "&lt;") from analyze route that permanently mutated contracts before analysis
2. Unbounded memory leaks — _chunk_cache and _prediction_cache replaced with BoundedCache (LRU, max 500/2000 entries)
3. Missing middleware.ts — Auth guard never executed; anyone could access dashboard without login
4. NLI input format wrong — Changed from [SEP]-concatenated string to proper (text_a, text_b) dict format for cross-encoder
5. Scan count race condition — Fixed table name mismatch (analysis_history vs analyses) and now uses profiles.analyses_this_month
6. RAG sessions never expired — Added TTL-based expiry (1 hour) for RAG sessions

🟠 HIGH-Severity Fixes

7. Hardcoded admin email removed — ankygaur9972@gmail.com removed from public schema.sql
8. Rate limiter improved — Sliding window with proper X-Forwarded-For IP extraction
9. Input size validation — Added 200KB max text limit to prevent DoS
10. Duplicate model loading eliminated — SentenceTransformer singleton in compare.py

🟡 MEDIUM-Severity Fixes

11. Train/inference alignment — Changed from sigmoid (multi-label) to softmax (matching single-label training)
12. Classifier max_length raised — 256→512 tokens (was truncating legal clauses)
13. Risk score formula fixed — Now uses absolute risk (diminishing returns), not normalized by document length
14. Compliance negation detection improved — Wider window (200 chars), sentence-boundary aware
15. Regex fallback coverage expanded — Added 20+ missing CUAD categories (Audit Rights, Insurance, Source Code Escrow, etc.)

⚡ Performance Fixes

16. O(n²) comparison → O(n+m) — Pre-compute all embeddings once, use matrix multiplication
17. Sequential NER → batched — Single pipeline call with batch_size=8 instead of per-chunk calls
18. Gradio SSE polling improved — Exponential backoff (500ms→2s) instead of fixed 1s, increased timeout to 90s
19. Loading skeleton added — loading.tsx for instant navigation feedback

Files Changed

• app.py — Core analysis engine (all ML fixes)
• compare.py — O(n²)→O(n) comparison
• compliance.py — Better negation detection
• api/main.py — Rate limiter, RAG session TTL, input validation
• web/middleware.ts — NEW: Auth guard (was missing entirely)
• web/app/api/analyze/route.ts — XSS fix, scan count fix, input validation
• web/app/api/chat/route.ts — Proper session handling documentation
• web/app/dashboard-pages/analyze/loading.tsx — NEW: Loading skeleton
• web/lib/supabase/schema.sql — Removed hardcoded admin email