Changelog

All notable changes to the Clinical Risk Modeling Engine for medication diversion detection will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Fixed path traversal vulnerability in model upload endpoint: user-controlled filenames could write files outside the models directory via ../ sequences
Added filename sanitization with strict allowlist for alphanumeric characters, hyphens, underscores, and dots
Added file extension allowlist (.pkl, .joblib) to prevent upload of arbitrary file types
Added maximum upload size limit (100 MB) to prevent denial-of-service
Randomized stored filenames with cryptographic prefix to prevent overwrite attacks
Added upload validation: uploaded model is tested via joblib.load before confirming success; invalid files are cleaned up
Added security documentation warning about unsafe pickle deserialization in model loading
Replaced broken utils.logging import with stdlib logging in model_management.py

Initial project structure with api, data, models, services, utils, and tests directories
FastAPI application with main.py entry point
Configuration management with config.py
Requirements file with dependencies (FastAPI, scikit-learn, pandas, SHAP, LIME, etc.)
ML model implementation using Gradient Boosting for diversion detection
Data processing module for feature engineering
Evidence-based evaluation framework using DEA, CDC, and SAMHSA guidelines
XAI service with SHAP and LIME integration
Database integration with SQLAlchemy
API endpoints for risk assessment, patient data, and model management
Risk calculation service with evidence-based and ML risk scoring
Patient management service with CRUD operations
Comprehensive README documentation
License file (MIT)
.gitignore for GitHub compatibility
Contribution guidelines
Setup configuration for Python packaging
Public data sources documentation for testing
EHR integration planning documentation
Installation script and basic functionality tests
Synthetic data generation capabilities
API endpoint testing framework

Changed disclaimer from popup modal to persistent banner on every screen
Fixed verifyProfessional function to properly show assessment section after verification
Added proper error checking in verifyProfessional function with element existence validation
Fixed syntax error in calculateFeatureImportance function that was preventing verification