Securing a RAG Pipeline — The Threats I Designed Against and the Ones I Didn't

Most RAG tutorials end when the pipeline answers a question correctly. That's where the security work begins. A RAG pipeline is an attack surface. Documents flow in. Queries flow in. Answers flow out. At each of those boundaries, something can go wrong in a way that a traditional security review wouldn't catch — because the vulnerabilities are...