Building RAG in Laravel: Four Ingestion Bugs That Silently Wreck Retrieval

mujahidabbas.dev - submitted by Muhammad Mujahid Abbas

Every Laravel RAG tutorial builds the same ingestion pipeline (chunk, embed, store) and stops the moment the agent answers on screen. None of them check whether retrieval is any good. But retrieval quality is decided at ingestion, before the model runs once, and four decisions there fail with no error, no exception, no failed test: - **Chunking** that severs the answer mid-sentence, so `answer@1` falls while `source hit@1` still looks healthy. - An **HNSW index** built with `vector_l2_ops` while you query with cosine `<=>`. Postgres silently ignores the index and scans every row. Laravel 13's native `whereVectorSimilarTo()` hardcodes `<=>`, so it's easier to hit than ever. Shown with `EXPLAIN`. - The **embedding dimension** baked into the `vector(1536)` column type, so "shrink it to save storage" is a migration plus a full re-embed that quietly drops retrieval to 47%. - **Ingesting and querying with different models**, which turns every distance into noise. Each bug is real code from a working repo, proven against an eval suite. It's the prequel to my earlier "Evaluating RAG in Laravel" post: build it, prove it, tune it. Every example verified against `laravel/ai` v0.7.2 and pgvector, with the full repo to clone.

Read more [mujahidabbas.dev]

Prompt-Injection Guardrails in Laravel: Defend the Tools, Not the Prompt

mujahidabbas.dev - submitted by Muhammad Mujahid Abbas

You can't out-prompt an attacker — to the model, your system instructions and a malicious support ticket are the same text. So stop defending the prompt and lock down the boundaries you actually control: tools scoped to the authenticated user server-side, middleware that screens and logs, output handled as untrusted input, a human in front of anything irreversible, and a fake-free test that fails CI the moment someone drops the auth scope.

Read more [mujahidabbas.dev]