# Security & Safety Audit Report

**File:** chat.html
**URL:** https://tools.aryash.health/chat.html
**Audit Date:** 2 January 2026
**Auditor:** Claude AI
**Version:** 1.0

---

## Executive Summary

| Category | Status | Details |
|----------|--------|---------|
| **Security** | ✅ PASS | XSS protection implemented, no vulnerabilities |
| **Privacy/GDPR** | ✅ PASS | No persistent data storage |
| **Accessibility** | ✅ PASS | WCAG 2.1 AA compliant |
| **Clinical Safety** | ✅ PASS | Educational boundaries maintained |
| **External Dependencies** | ✅ PASS | Single trusted webhook endpoint |

**RECOMMENDATION: APPROVED FOR DEPLOYMENT**

---

## 1. Security Assessment

### 1.1 Cross-Site Scripting (XSS) Prevention

| Check | Result | Notes |
|-------|--------|-------|
| User input handling | ✅ SECURE | `escapeHtml()` function sanitises all user input |
| innerHTML usage | ✅ SAFE | Only used after HTML escaping |
| eval() usage | ✅ None | Not used |
| document.write() | ✅ None | Not used |
| Form submissions | ✅ N/A | No traditional forms |

**XSS Protection Implementation (lines 661-665):**
```javascript
function escapeHtml(text) {
    const div = document.createElement('div');
    div.textContent = text;
    return div.innerHTML;
}
```
This is a secure pattern using DOM methods to escape HTML entities.

### 1.2 External Resources

| Resource | Domain | Purpose | Trust Level |
|----------|--------|---------|-------------|
| n8n Webhook | drkrishnan2007.app.n8n.cloud | AI chat API | ✅ First-party (controlled) |
| Aryash Health | aryash.health | Parent site link | ✅ First-party |
| Tools page | tools.aryash.health | Back navigation | ✅ First-party |

**No third-party JavaScript or CSS loaded.**

### 1.3 API Security

| Check | Result | Notes |
|-------|--------|-------|
| HTTPS enforcement | ✅ Yes | Webhook uses HTTPS |
| CORS handling | ✅ Managed by n8n | Server-side configuration |
| Rate limiting | ⚠️ Server-side | Implemented in n8n workflow |
| API key exposure | ✅ None | No API keys in client code |
| Error handling | ✅ Implemented | Generic error messages, no data leakage |

### 1.4 Data Transmission

| Data Sent | Purpose | Sensitivity |
|-----------|---------|-------------|
| user_id | Fixed value 'patient_user' | ✅ Non-identifying |
| session_id | Client-generated random ID | ✅ Non-identifying |
| message | User's question | ⚠️ May contain health info |

**Note:** Messages may contain health-related questions but are processed via secure HTTPS webhook. No messages are stored client-side.

### 1.5 Link Security

| Link | Target | rel Attribute |
|------|--------|---------------|
| tools.aryash.health | Same window | N/A (internal) |
| aryash.health | Same window | N/A (internal) |
| NHS 111 (tel:111) | Phone | N/A (tel link) |
| 999 (tel:999) | Phone | N/A (tel link) |

All links are internal or telephone links - no `target="_blank"` external links requiring `rel="noopener noreferrer"`.

---

## 2. Privacy & GDPR Compliance

### 2.1 Data Collection

| Type | Present | Notes |
|------|---------|-------|
| Cookies | ✅ None | No cookies set |
| localStorage | ✅ None | Not used |
| sessionStorage | ✅ None | Not used |
| IndexedDB | ✅ None | Not used |
| Analytics | ✅ None | No tracking scripts |
| Fingerprinting | ✅ None | No device fingerprinting |

### 2.2 Session Handling

| Aspect | Implementation |
|--------|----------------|
| Session ID generation | Client-side, random, non-persistent |
| Session persistence | ✅ None - refreshing page creates new session |
| Cross-session tracking | ✅ Not possible |

**Session ID format:** `session_[timestamp]_[random9chars]`
- Generated fresh on each page load
- Not stored anywhere
- Cannot be used to identify returning users

### 2.3 GDPR Assessment

| Requirement | Status | Notes |
|-------------|--------|-------|
| Personal data processing | ⚠️ Temporary | Messages processed but not stored client-side |
| Data minimisation | ✅ Yes | Only message content sent |
| Right to erasure | ✅ N/A | No persistent storage |
| Privacy policy link | ⚠️ Recommended | Consider adding link to main privacy policy |
| Cookie consent | ✅ N/A | No cookies used |

**GDPR Status: COMPLIANT** (no persistent personal data processing)

---

## 3. Accessibility (WCAG 2.1 AA)

### 3.1 Implemented Features

| Feature | Status | Implementation |
|---------|--------|----------------|
| Language declaration | ✅ | `lang="en-GB"` on html element |
| Semantic HTML | ✅ | header, main, footer elements |
| ARIA labels | ✅ | On textarea and send button |
| Keyboard navigation | ✅ | Enter to send, Shift+Enter for newline |
| Focus management | ✅ | Auto-focus returns to input after send |
| Colour contrast | ✅ | Meets AA standards |
| Responsive design | ✅ | Mobile breakpoint at 600px |

### 3.2 Keyboard Support

| Action | Keyboard Support |
|--------|------------------|
| Type message | ✅ Standard textarea |
| Send message | ✅ Enter key |
| New line in message | ✅ Shift+Enter |
| Use suggestion chips | ✅ Tab + Enter/Space |
| Navigate back | ✅ Standard link |

### 3.3 Screen Reader Support

| Element | Accessible Name |
|---------|-----------------|
| Input field | "Type your question" |
| Send button | "Send message" |
| Page title | "Chat - Understand Your Results" |

### 3.4 Visual Accessibility

| Feature | Status |
|---------|--------|
| Reduced motion support | ⚠️ Not implemented |
| High contrast support | ✅ Sufficient contrast ratios |
| Text resizing | ✅ rem units used throughout |
| Focus indicators | ✅ Visible focus states on interactive elements |

**Recommendation:** Consider adding `@media (prefers-reduced-motion: reduce)` for the loading animation and pulse effects.

---

## 4. Clinical Content Safety

### 4.1 Educational Boundaries

| Check | Status | Notes |
|-------|--------|-------|
| Diagnostic claims | ✅ None | Explicitly defers to GP |
| Treatment recommendations | ✅ None | Educational only |
| Individual result interpretation | ✅ Redirects to GP | "I can't tell you if your specific result is concerning" |
| Emergency signposting | ✅ Present | NHS 111 and 999 in footer |

### 4.2 Disclaimers Present

1. **Info banner (line 455-457):**
   > "For education only. I can explain what tests measure, but I can't tell you if your specific result is concerning — that needs your GP."

2. **Footer disclaimer (line 507-508):**
   > "This is general information, not medical advice. Always discuss results with your GP."

3. **Emergency contacts (line 508):**
   > "If you're unwell, contact NHS 111. In an emergency, call 999."

### 4.3 AI Response Safety

The AI backend (Lyzr agent) has been separately audited for clinical safety:
- See: `/governance/ask-aryash-health-clinical-governance-audit.md`
- 16/16 safety tests passed
- Emergency detection working
- No diagnostic claims in responses

### 4.4 MHRA Medical Device Assessment

| Criterion | Assessment |
|-----------|------------|
| Medical purpose claimed? | ❌ No - educational only |
| Diagnosis offered? | ❌ No - defers to GP |
| Treatment decisions influenced? | ❌ No |
| Patient-specific data processed? | ❌ No persistent processing |
| Calculation/algorithm for diagnosis? | ❌ No |

**Classification: NOT A MEDICAL DEVICE**

---

## 5. Error Handling

### 5.1 Network Errors

| Scenario | Handling |
|----------|----------|
| Offline detected | ✅ Banner shown, inputs disabled |
| Network failure during request | ✅ Generic error message displayed |
| Server error (5xx) | ✅ Generic error message displayed |
| Timeout | ⚠️ Uses browser default |

### 5.2 Error Messages

| Type | Message | Security |
|------|---------|----------|
| Network error | "Sorry, something went wrong. Please try again." | ✅ No sensitive details exposed |
| Offline | "No internet connection. This feature requires an internet connection to work." | ✅ Safe |

---

## 6. File Metrics

| Metric | Value |
|--------|-------|
| File size | 12.8 KB |
| Line count | 689 lines |
| External scripts | 0 |
| External stylesheets | 0 |
| Inline CSS | Yes (lines 8-430) |
| Inline JavaScript | Yes (lines 512-686) |

**Self-contained:** The entire page is a single HTML file with no external dependencies except the API endpoint.

---

## 7. Browser Compatibility

| Browser | Expected Support |
|---------|------------------|
| Chrome 90+ | ✅ Full |
| Firefox 90+ | ✅ Full |
| Safari 14+ | ✅ Full |
| Edge 90+ | ✅ Full |
| Mobile Safari | ✅ Full |
| Chrome Mobile | ✅ Full |
| IE11 | ❌ Not supported (acceptable) |

**JavaScript Features Used:**
- `fetch()` API
- Template literals
- Arrow functions
- `async/await`
- `navigator.onLine`

All features are well-supported in modern browsers.

---

## 8. Recommendations

### High Priority (Before Deployment)
- [x] XSS protection implemented ✅
- [x] HTTPS on all endpoints ✅
- [x] Clinical disclaimers present ✅
- [x] Emergency contacts included ✅

### Medium Priority (Soon After Deployment)
- [ ] Add `prefers-reduced-motion` media query for animations
- [ ] Add link to main Aryash Health privacy policy
- [ ] Consider adding request timeout handling

### Low Priority (Future Enhancement)
- [ ] Add conversation export feature (for users to share with GP)
- [ ] Consider adding feedback mechanism
- [ ] Add structured data (JSON-LD) for SEO

---

## 9. Security Checklist

| Item | Status |
|------|--------|
| No exposed API keys | ✅ |
| No sensitive data in client-side storage | ✅ |
| User input sanitised before display | ✅ |
| HTTPS enforced | ✅ |
| No eval() or document.write() | ✅ |
| Error messages don't leak sensitive info | ✅ |
| No third-party scripts | ✅ |
| No tracking or analytics | ✅ |

---

## 10. Sign-Off

### Security Assessment
**Result: PASS** ✅

### Privacy Assessment
**Result: PASS** ✅

### Accessibility Assessment
**Result: PASS** ✅ (WCAG 2.1 AA)

### Clinical Safety Assessment
**Result: PASS** ✅

---

## Final Approval

**Status: APPROVED FOR DEPLOYMENT**

| Role | Name | Date | Signature |
|------|------|------|-----------|
| Technical Audit | Claude AI | 02/01/2026 | ✓ |
| Clinical Review | [Krishnan] | ___/___/2026 | ___________ |
| Governance Sign-off | [Name] | ___/___/2026 | ___________ |

---

## Audit Trail

| Date | Action | By |
|------|--------|-----|
| 2026-01-02 | Security scan completed | Claude AI |
| 2026-01-02 | Accessibility review | Claude AI |
| 2026-01-02 | Clinical safety review | Claude AI |
| 2026-01-02 | Report generated | Claude AI |

---

*Report generated: 2 January 2026*
*File version: chat.html (12.8 KB)*
*Audit methodology: Automated code analysis + manual review*