A key sealed in a glass block inside a stream of fibre-optic light, protected by a cyan shield

AI Collaboration App

Software & SaaS
Software & SaaS

AI Collaboration App

An application that lets people collaborate with AI agents handles API keys, queued messages and user settings - exactly the places where a quiet bug does lasting damage. RemSoft.Dev developed it with ConnectOtherAIs, the review gate of Dew Flow, reviewing the work, and the findings led to five concrete fixes. Resetting an agent session used to delete messages that had not been delivered yet; pending messages are now preserved. Changing a single setting used to reset all 16 to their defaults; a test reproduced it first, and the update now keeps the rest of the user's configuration. The delete-everything action left encrypted keys behind in quarantine; it was corrected, and the interfaces were separated so the wrong wiring no longer compiles. An API key split across two streamed response chunks could survive redaction; seven tests reproduced it before the fix closed the chunk boundary. Search pagination skipped results when attachments had identical text; a traversal test now guards it.

AI code reviewSecret handlingData integrityConnectOtherAIs

Key Challenges

Client: AI collaboration software company

Product: AI collaboration application

Review: ConnectOtherAIs - plan and code rounds

Approach: Every fix reproduced by a failing test first

The project faced several key challenges:

  • Secrets in a stream: An API key split across two streamed chunks slipped past redaction. Seven failing tests reproduced it before the fix.
  • Delete must mean delete: Delete-all kept encrypted keys in quarantine. The fix, and a type-level separation, make the wrong wiring impossible.
  • Small updates, big side effects: One settings change reset all 16 settings; one session reset dropped queued messages. Both now preserve the user's data.

Results

  • Queued messages preserved across session resets
  • One-field settings updates keep the other settings
  • Delete-everything removes encrypted keys
  • Streamed API keys redacted across chunk boundaries
  • Search pagination returns every matching result

5 defects

in data handling and secret protection fixed after review.

7 tests

reproduced the streamed-secret leak before the fix.

16 settings

now preserved when a user changes just one.

Related case studies

Want to Build Something Similar?

Tell us about your project - we will propose an approach, a timeline and a first estimate.

An unhandled error has occurred. Reload 🗙