Repository navigation
Later: filter chat RAG by saved standards selection #1085
Description
Parent: #1079 · Not a November blocker · Project: https://github.com/orgs/OWASP/projects/60
What
Product choice, tracked so it does not get silently skipped or silently done.
Chat (/rest/v1/completion) already requires login (spend control). Retrieval is not limited by user_resource_selection. A user who filtered the site to ASVS+CWE can still get answers citing NIST, cheat sheets, etc.
Decide then implement
- Decide: should chat respect the profile view, always use the full corpus, or offer a toggle?
- If yes: pass selected standard names into
PromptHandlerretrieval and drop/hide out-of-view citations - Empty selection = current behaviour (full corpus)
- Do not weaken login on
/completion(Nest Agent service contract is Cited ask API + MCP tools so NestBot can ground security answers in OpenCRE #1074, unrelated)
Why later
Roadmap “user profiles with persistent standards filter” is the site view. Chat corpus filtering is a separate UX (users often want the chatbot to see everything). Ship CRE/search/explorer first.
Related
application/web/web_main.pychat_cre- Nest cited-ask: Cited ask API + MCP tools so NestBot can ground security answers in OpenCRE #1074
Activity
Dreamstick9 commentedon Sep 16, 2026
hey @northdpole ,I wanted to work on this but had some questions,
when someone has standards saved, what should chat do? only search their picks, keep searching everything like it does now, or use their picks by default with a toggle to search all (kinda like ?all=true)?
also if the filtered search doesn't find a good match, should it fall back to the normal uncited answer like today, or just tell the user that nothing in their standards matched?
and #1102 touches prompt_client.py too, should I wait for that to merge first?