Secure Portfolio RAG Assistant

This project presents the development and deployment of the chatbot integrated into this portfolio. Designed to fluently and accurately answer visitors’ questions about my projects and background, the assistant relies on an agentic RAG (Retrieval-Augmented Generation) architecture combining strict cloud free-tier quota management with security and resilience mechanisms.

Context

This chatbot was primarily built as a showcase to illustrate key software engineering and AI skills acquired during my internships and academic curriculum, which were not directly demonstrated in my other projects.

• Objective: Put into practice a complete autonomous agent capable of managing real production constraints: strict API quota and rate-limiting enforcement, interception of potential error causes, fault tolerance, multiplatform communication (web, API), and user session isolation.
• Business Need: Provide an interactive assistant on the portfolio capable of guiding recruiters and visitors through my achievements without requiring a permanent paid server.

Cloud Architecture & Constraints

The main engineering challenge was to deliver a high-performing service with fast response times while operating strictly on cloud free tiers (free-tier).

• Render (FastAPI Backend): Hosting the Python API. Free-tier constraints impose 512 MB of RAM, automatic sleep after 15 minutes of inactivity (cold start), and ephemeral storage reset upon restart.
• Pinecone (Vector Database): Serverless indexing for vector storage and cosine similarity search.
• Groq (LLM Inference): Leveraging Groq’s LPUs (Language Processing Units) for model inference, requiring strict compliance with requests-per-minute (RPM) and tokens-per-minute (TPM) limits.
• Pinecone Inference API (Embeddings): To bypass the impossibility of loading heavy embedding models within Render’s limited RAM (512 MB), vectorization is delegated to Pinecone’s API using the multilingual-e5-large model, ensuring near-zero memory footprint on the backend.

Methodology & Agentic Pipeline

The pipeline relies on the LangChain framework to orchestrate information flow, conversation state, and agentic decision-making.

1. Strategic 3-Chunk Project Partitioning

To avoid overwhelming the LLM with unnecessary context and to drastically shrink prompt size, each portfolio project is strategically divided into exactly 3 distinct typed chunks:

1. Chunk 1 - Summary & Context: General overview, business problem, and environment.
2. Chunk 2 - Data & Methodology: Data preparation, architectural choices, and algorithms.
3. Chunk 3 - Results & Takeaways: Achieved performance, key metrics, and conclusions.

2. Dictionary-Based Chunk Management

To maximize token savings under strict free-tier constraints:

• Targeted Search: Vector indexing is coupled with a hash lookup table (mapping dictionary). Vector search identifies the exact project or section involved and extracts only the strictly necessary chunk using a top-k = 1 parameter.
• Strict Token Limitation: This precise targeting avoids sending multiple heavy blocks to the LLM, reducing token consumption to a minimum and eliminating the risk of exceeding Groq’s TPM quotas.

3. Two-Pass ReAct Agentic Pattern

The assistant operates using the ReAct (Reasoning + Acting) pattern executed in two separate passes via LangGraph:

• Pass 1 (Analysis & Retrieval): The model analyzes the user’s question, evaluates whether document retrieval is required, identifies intent, and extracts the appropriate contextual chunk via targeted vector search.
• Pass 2 (Reasoning & Synthesis): The model receives the precise contextual chunk injected into a structured system prompt, applies guardrails, formats the response, and generates the final output for the user.

Security, Robustness & Error Interception

Publicly exposing a chatbot requires rigorous controls to avoid DoS attacks, quota leaks, and script injection.

1. Error Interception & Degraded Mode

• Quota & Outage Handling: Global HTTP request exception catching (timeouts, Groq or Render 429 Rate Limit errors). If inference APIs become unavailable, the system gracefully fails over to a degraded mode with clear error messages.

2. Anti-DoS Safeguards & Rate Limiting

• Token Bucket: Control of request rates per IP address to prevent abuse.
• Daily Token Cap: Fine-grained per-IP token consumption tracking imposing a strict daily limit to ensure a single malicious user cannot block access for others.

3. Session Isolation (Anti-IDOR)

• Client-Side UUIDv4 Tokens: A unique UUIDv4 identifier is generated in browser localStorage.
• IDOR Protection: Conversation history remains sealed to this UUIDv4, prohibiting anyone from viewing another user’s session without a valid token.

4. XSS Sanitization

• Strict Escaping: All LLM-generated Markdown is cleaned and sanitized (backend and frontend) before DOM insertion to neutralize HTML/JS injection attacks.

Results

The assistant offers responsive response times while guaranteeing zero infrastructure cost. The 3-chunk partitioning strategy paired with k = 1 selection ensures strict compliance with free-tier API quotas, making this chatbot a complete and robust demonstration of applied software engineering for LLMs.