I built Atlas AI, a private copilot where you upload documents, ask questions, and every answer cites the page it came from. The part I cared about most was tenant isolation: one workspace's text must never reach another's answer.

Demo: https://atlasai-beta.vercel.app (continue as guest)

Code: https://github.com/yashwanthvarmakonduru/Atlas-AI

The setup

Every search is filtered to one workspace by server code, never by the model. Search is hybrid: a vector search for meaning and a keyword search for exact names, merged with reciprocal rank fusion. I wrote an isolation test suite and it passed.

The bug

Then I deleted the workspace filter from the keyword search to see what would break. The suite still passed.

A later lookup repeated the filter and quietly dropped the leaked results. Two layers of defence meant the failure of the first one was invisible. My tests were checking the final answer, not each layer.

The fix

I exported each search stage and attacked them one at a time.…