KAI-VORAL-RCA-001 — Root Cause Analysis (RCA)

Template ID: TPL-09-05 | Stage: 09-Operate-and-Maintain | Version: 0.3
Status: Project record created from the controlled template.

Purpose: Find, with evidence, why an incident or defect happened and define corrective and preventive actions (CAPA).

Required inputs: Incident record; logs; code history.

Document control

Field	Required entry
Document ID	KAI-VORAL-RCA-001
Template used	TPL-09-05 Root Cause Analysis (RCA) v0.3
Product / project / software version or commit SHA	VORAL (Visionary Oral) / PRJ-001 / a6b4429e3165 (branch app_dev of AI-Dental-Project/Visionary_Oral)
Record status and version	Draft v0.1
Author / technical reviewer / quality reviewer	Claude Code (drafted with Claude Code for KrinosAI) / Tech Lead (name to be assigned) / Security & Privacy Officer (name to be assigned)
Created / updated / approved dates	2026-10-28 / 2026-10-28 / Pending
Applicable SOP and revision	SOP-LC-09 v0.3
Related issue, commit, requirement and evidence links	KAI-VORAL-INC-001
Approver and decision record	Pending

Applicability and evidence baseline

Product / system boundary: Web app and API (dentalapp/), doctor/admin mobile app (mobile/), on-device models (mobile/assets/models/), PDF Lambda (dentalapp/pdf-lambda/) at a6b4429e3165, and the external services they call. Related approved requirements, risks and change records: None approved. Related drafts are listed in document control. Retrospective record? Yes — follows the Retrospective Documentation Protocol (KrinosAI lifecycle pack, 05-References/). Items are labelled Observed (code or Git at a6b4429), Measured (dated run), Stated (named person, dated) or Not recorded. No operations records (monitoring, incidents, complaints, backups) existed before this documentation. Operations found in the code are labelled Observed; everything else is a proposal for its owner. Acceptable evidence: an implementation reference (file:line at a commit SHA), a dated test record, a signed decision, a vendor agreement, or another independently verifiable artifact. Never invent approvals, clinical results, measurements or performance data.

1. Problem definition and impact

Item	Entry
Problem	Credential files and database backups are tracked in the Git repository
Impact	Anyone with repository access, now or in the past, can read them

2. Timestamped evidence timeline

Time (UTC)	Event	Evidence
2025-11-13	MongoDB credentials file committed	Commit d55e801
2025-12-06	Ignore rule added after the file was already tracked	Commit 70b00b5; .gitignore:97
2026-01-01	Google credentials committed	Commit 5130774

3. Contributing factors and causal graph

Factor	Type
No secret scanning or CI checks	Process (OPEN-039)
No required PR review	Process (OPEN-038)
.gitignore does not untrack files already committed	Technical
No rule for backups/ or google-credentials.json in .gitignore	Technical

4. Five whys or fault tree with proof

Why	Answer	Proof
1. Why are secrets readable?	They are in Git	git ls-files at a6b4429
2. Why are they in Git?	Committed directly to shared branches	Git history
3. Why was the ignore rule not enough?	Ignore rules do not apply to tracked files	.gitignore:97 added after d55e801
4. Why was it not caught?	No review or automated secret scan	OPEN-038, OPEN-039
5. Why no controls?	No secure development process was set up at project start	Not recorded — no process documents found

5. Containment corrective and preventive actions

Action	Type	Owner
Rotate both credentials	Containment	Security & Privacy Officer
Remove files and purge history	Corrective	Tech Lead
Secret scanning in CI and pre-commit	Preventive	Tech Lead
Required PR reviews	Preventive	Tech Lead

6. CAPA owners efficacy tests and deadlines

CAPA	Effectiveness check	Due
Rotate credentials	Old credentials fail to sign in	2026-10-31 (proposed)
Secret scanning	A test secret in a PR is blocked	2026-11-30 (proposed)

7. Recurrence monitoring and closure approval

Item	Entry
Recurrence check	Secret scan of every PR and monthly scan of history
Closure	Pending — Security & Privacy Officer

Open issues and decisions

ID	Specific gap or decision	Responsible owner	Due date	Blocks gate?	Evidence required	Status
OPEN-001	Tracker project ID, named requester and sponsor, and named reviewers are not recorded	Product Owner	2026-11-10 (proposed)	Yes	Tracker entry; names with roles	Open
OPEN-007	Credential files committed to Git: dentalapp/google-credentials.json, dentalapp/mongoDb_usernamePassword (contents not opened)	Security & Privacy Officer	2026-10-31 (proposed)	Yes	Credentials rotated; files removed and purged from history; confirmation	Open
OPEN-008	Database backups with personal data committed to Git: 9 files under dentalapp/backups/ (commit 92a4b77; contents not opened)	Security & Privacy Officer	2026-10-31 (proposed)	Yes	Files purged from history; breach/incident assessment recorded	Open
OPEN-038	No branch protection, required reviews or CODEOWNERS recorded; changes are pushed directly to shared branches (app_dev, non-compliance)	Tech Lead	2026-11-15 (proposed)	Yes	Branch protection settings; PR template; CODEOWNERS	Open
OPEN-039	No CI pipeline builds, lints, tests or scans the code; the only workflow is the ML keep-awake job	Tech Lead	2026-11-30 (proposed)	Yes	CI workflow running build, lint, tests, audit and secret scan on every PR	Open

Review and approval

Review role	Named individual	Decision	Date	Signed / controlled record
Author	Claude Code (drafted with Claude Code)	Draft	2026-10-28	This file at the commit that adds it
Technical reviewer	Tech Lead (name to be assigned)	Pending	Pending	Pending
Quality / regulatory reviewer (if applicable)	Qualified regulatory reviewer (name to be assigned)	Pending	Pending	Pending
Authorized approver	Security & Privacy Officer (name to be assigned)	Pending	Pending	Pending