import uvicorn occurs after executable statements (sys.stdout.reconfigure / sys.stderr.reconfigure). With Ruff E402 enabled for pyrit/**, this is likely to fail linting as a non-top-level import. Move the uvicorn import up with the other imports (and keep the reconfigure calls after all imports), or wrap the reconfigure logic inside main() so imports remain at the top of the module.

The 500 error path returns a full Python traceback to the API caller. This can leak sensitive details (file paths, environment variables, internal URLs, tokens) and makes it hard to safely run the backend outside of a trusted dev environment. Gate this behavior behind an explicit debug flag (e.g., DEV_MODE / config), and otherwise return a generic error message while logging the traceback server-side.

_is_azure_blob_url currently checks for the substring .blob.core.windows.net/ anywhere in the URL. This can misclassify non-Azure URLs (e.g., a malicious host with that string in the path) and trigger server-side requests / signing attempts, creating an SSRF surface area. Parse the URL and validate that netloc ends with blob.core.windows.net (and ideally enforce an allowlist of expected storage accounts/containers) before treating it as an Azure Blob URL.

add_attack_results_to_memory introduces local imports for closing and SQLAlchemyError even though closing is already imported at module scope. This adds noise and conflicts with the project's "imports at the top of the file" convention. Please remove the redundant local import and move SQLAlchemyError to the module imports (or reuse an existing top-level import) so this method contains only logic.

The helper methods _get_last_message_preview, _count_messages, and _get_earliest_timestamp appear to be unused in this module (no call sites besides their definitions). Keeping unused code makes future refactors harder and increases maintenance cost; consider removing them or wiring them into the conversation-summary logic if they are intended as a fallback.

MemoryInterface.get_attack_results() currently takes attack_class/converter_classes (see pyrit/memory/memory_interface.py), so calling it with attack_type= will raise TypeError. Either update the memory interface + implementations to the new parameter name, or keep the tests using attack_class= to match the current API.

get_conversation_messages can surface a ValueError from the service when conversation_id is not part of the attack. Right now that exception is unhandled (will return 500) and the 404 branch always reports “Attack not found”, which is misleading when the attack exists but the conversation is invalid. Consider catching ValueError here and returning 400, and returning a clearer 404 only when the attack itself is missing.

The 500 handler for POST /{attack_result_id}/messages returns the full Python traceback in the HTTP response body. This can leak internal paths, environment details, and secrets to clients. Please gate this behavior behind an explicit debug/development flag and return a generic error message in production (while still logging the traceback server-side).

These tests use converter_types as the keyword for converter filtering, but MemoryInterface.get_attack_results currently expects converter_classes. Either update the tests to use the implemented keyword, or rename/alias the memory interface parameter (and all implementations) so the call site matches.

The tests reference get_unique_attack_type_names() / get_unique_converter_type_names(), but the memory interface currently exposes get_unique_attack_class_names() / get_unique_converter_class_names(). This will fail at runtime unless the interface was renamed accordingly. Please update the tests to match the implemented method names, or implement the renamed methods (optionally keeping the old names as aliases for compatibility).

get_conversation_messages_async currently only treats PRUNED related conversations as belonging to the attack. After change_main_conversation_async, the old main conversation is moved to ADVERSARIAL related conversations, which would then be rejected here. Consider allowing all related conversation IDs (or at least PRUNED + ADVERSARIAL + SCORE) when validating membership so users can still fetch messages for any conversation attached to the attack.

add_message_async uses request.target_conversation_id as the conversation to write to, but it never validates that this conversation_id belongs to the attack (main or related). As-is, a client could write messages into an unrelated conversation_id and still update the attack metadata, potentially corrupting data. Please validate msg_conversation_id against the attack's allowed conversation IDs before reading/writing pieces and before calling _send/_store.

change_main_conversation_async updates conversation_id and related-conversation columns, but it doesn't update the attack metadata (e.g., updated_at). This can cause the attack list ordering and “last updated” timestamp to be stale after a main-conversation swap. Consider persisting an updated attack_metadata.updated_at alongside the other updates.

These assertions check for converter_types in the kwargs passed to mock_memory.get_attack_results, but the service currently forwards this filter as converter_classes=... (matching MemoryInterface.get_attack_results). As written, this test will fail. Update the expected kwarg key to converter_classes (or rename the memory-layer parameter and the service call consistently if the interface is meant to change).

This test asserts the call forwarded converter_types, but AttackService.list_attacks_async() calls the memory layer using converter_classes=converter_types. This mismatch will cause the test to fail; assert against converter_classes (or update the memory interface + service together if the memory API is being renamed).

Conversation membership validation here only considers related conversations of type PRUNED. However, the API and service also manage other related conversation types (e.g., ADVERSARIAL via change_main_conversation_async). As a result, GET /attacks/{attack_result_id}/messages will incorrectly reject valid related conversations. Include all conversation IDs from ar.related_conversations (or explicitly document/implement which types are supported) when validating conversation_id.

get_conversations_async only returns the main conversation plus PRUNED related conversations. This will omit other related conversation types already tracked on AttackResult (e.g., adversarial chat or scoring conversations), so the endpoint won’t actually “list all conversations for an attack”. Consider including all ar.related_conversations in all_conv_ids (and in the response), or explicitly filtering with a documented rationale if only certain types should be exposed.

_persist_base64_pieces currently persists any piece that isn’t text or error, including valid non-file PromptDataTypes like reasoning, url, function_call, etc. Those values are not base64-encoded files and will either be corrupted or cause decode/write failures. Restrict persistence to the *_path/binary_path types (and leave other non-text types untouched).