Vartovii logo

Release notes

Vartovii Changelog

Release archive
3.2.20

SQL Injection Eliminated & Hardcoded Credentials Removed

Release v3.2.20 focuses on SQL Injection Eliminated, Hardcoded Credentials Removed, and Vacancy Connector Authentication Bug.

ImprovedFixedInternal
SQL Injection Eliminated & Hardcoded Credentials Removed

Release digest

Improved

  • SQL Injection Eliminated - CRITICAL security vulnerability fixed
    • Replaced f-strings with parameterized queries in ai_report_generator.py
    • All database queries now use (%s, %s) placeholders
    • Affected: AI Report generation, review queries
    • Impact: Prevents SQL injection attacks via company name manipulation
  • Hardcoded Credentials Removed - 3 files cleaned
    • backend/database.py - Removed host="34.65.148.71"
    • vartovii/integrations/kununu_connector.py - Removed hardcoded IP + credentials
    • vartovii/scrapy_services/vacancy_connector.py - CRITICAL FIX (see Fixed section)
    • Now uses get_db_connection() for all DB operations
    • Proper environment variable fallback chain
  • AI Report Review Limit - Increased from 100 → 500 reviews
    • 5x more data for AI analysis
    • Better quality investment memos
    • Smart truncation at 50k characters (prevents mid-review cuts)
  • AI Report Token Limit - 25k → 50k characters
    • 2x capacity for comprehensive analysis
    • No more incomplete reports for large companies
  • Database Connection Priority - Improved connection logic
    • Priority: DATABASE_URL > env vars > explicit parameters
    • Clear error messages for missing configurations
    • Multi-environment support (local, Cloud SQL, production)

Fixed

  • Vacancy Connector Authentication Bug - CRITICAL - All vacancies now work!
    • Root Cause: vacancy_connector.py:242 used hardcoded production IP + wrong user 
      # OLD (BROKEN)
conn = psycopg2.connect(
    host="34.65.148.71",  # Hardcoded!
    user="sentry_user"     # Wrong user!
)
# Error: password authentication failed for user "sentry_user"
    • Fix: Import get_db_connection() from backend 
      # NEW (WORKS)
from database import get_db_connection
conn = get_db_connection()
    • Impact: Vacancy connector now works for ALL companies (was failing 100%)
  • Cloud SQL Proxy v2 Syntax - Updated scripts/connect_db_proxy.sh
    • Old: cloud-sql-proxy -instances=... (deprecated)
    • New: cloud-sql-proxy --port 5434 CONNECTION_NAME (v2 syntax)
    • Prevents "unknown flag" errors on newer proxy versions

Internal

  • Data Collection Services Reorganization
    • Moved: vartovii/services/ → vartovii/scrapy_services/
    • Better separation of concerns
    • Updated imports across codebase
  • Improved .gitignore
    • Added vartovii/data/serpapi_usage.json (auto-generated)
    • Added *.db files (local SQLite databases)
  • Added: docs/infrastructure/VERTEX_AI_CONFIG.md - Vertex AI setup guide
  • Updated: Code examples with correct import paths

Technical notes