Skip to content
← The libraryHard

Multi-Tenant RAG Isolation & Connection Pool Leakage

Isolate tenant state contamination across Fastify, PostgreSQL RLS, pgvector, and async BullMQ workers under high concurrency.

TypeScript · PostgreSQL · pgvector · Supabase RLS · BullMQ / Redis · Fastify

Clock
45 min
Median
38 min
Ship rate
29%
Attempts
24

Source

Created by AGISports based on real production infrastructure incidents.

Critical production incident

RAG vectors leaking between competing tenants

An enterprise SaaS platform runs semantic search and real-time document ingestion for hundreds of companies on a single shared PostgreSQL database, using pgvector and Supabase Row Level Security (RLS).

Under concurrent traffic spikes, customers report receiving RAG vector fragments belonging to competing companies in the answers the system generates.

System architecture · 5 live components

01 / API GATEWAY
Fastify Framework

Receives HTTP requests, validates JWTs and extracts the tenant_id from the session.

02 / DATABASE LAYER
PostgreSQL + RLS + pgvector

RLS policies on the vector table, and HNSW indexes over 1536-dimension embeddings.

03 / CONNECTION POOL
pg-pool Engine

Reusable pooled TCP connections, managed for high concurrency.

04 / ASYNC QUEUE
BullMQ + Redis

Background re-ranking and vectorisation of large documents.

05 / LOCAL TEST AND LOAD HARNESS
Integration suite & concurrent load simulator

Local development tests (npm test) and a multi-tenant concurrent load simulator (npm run test:load).

The golden rule of shipping

45 minutes max · 1 single git push

You have a clock budget of 45 minutes maximum to diagnose the incident with your editor or AI agent, and to make ONE SINGLE git push to your forked repository once you consider the fix 100% verified.

How to run it

  1. 01Fork the pre-loaded arena repository containing all source code and maintainer test suites.
  2. 02Start a full-screen recording before you open the repo. The reviewer scores what you decided, so the screen has to show it.
  3. 03Orchestrate your AI (Claude Code, Cursor, Antigravity, Codex...) locally. Do NOT make trial-and-error pushes.
  4. 04Make a SINGLE git push to your fork when you consider your solution 100% ready. The green test run timestamp is your score time.

Read all of the above before you start.

Starting shares your screen, opens your arena and begins the clock — in that order, and none of it can be undone. You get one attempt and one push.

Start this drill