This page is for the people who sign off on software: procurement, IT security and accessibility offices. Each section links to the files it comes from, so you can check it against the code.
Checked against FirstPass 1.75.0 on 2026-10-18.
What FirstPass is and is not
FirstPass is an educational desk for learning how medicines interact. It shows mapped enzyme and body-effect collisions, FDA label excerpts and published scales, with links to the sources behind them.
Who it is for. For licensed healthcare professionals, and for students in accredited health-professions programs using it for education under faculty or preceptor supervision.
This software has not been cleared or approved by the U.S. Food and Drug Administration. Display of FDA-label text does not make FirstPass an FDA-cleared device.
It is not for
Patients acting without a licensed healthcare professional.
Generating a prescription, a milligram, a take-home, or an induction protocol.
Patient self-treatment, recreational dosing, or informal harm-reduction guidance meant to replace professional assessment.
Charting, billing, PDMP query, or storing protected health information.
Processing medical images, waveforms, or device signals.
Replacing the FDA-approved Prescribing Information, a poison-control consult, or bedside assessment.
Limits stated in the instructions for use
FirstPass is not FDA-cleared and not FDA-approved. Do not describe it as either.
The FDA-approved Prescribing Information is the authority. If this desk and the label disagree, the label wins.
This software is for educational harm-reduction and recreational-safety review, not patient-directed treatment, self-dosing, or a substitute for clinical judgment.
Absence of a mapped collision is not proof of safety. Transporters, UGT, plasma protein, unlisted metabolites, and unpublished interactions still apply.
Live OpenFDA / DailyMed excerpts are truncated. Open the full SPL before acting.
Street-supply rows (xylazine, nitazenes, designer benzos) are teaching maps, not labeled products.
Harm-reduction copy paraphrases DanceSafe, PsychonautWiki, TripSit, SAMHSA, and CDC. Live wiki extracts are sanitized of milligrams and route how-to; a wiki is still not a Prescribing Information. Independently review.
COWS, CIWA-Ar, Hunter, MME, QTc, and CYP start/stop clocks are published formulas and FDA-grade paraphrases displayed for independent scoring — not a diagnosis, not a hold, not a documented vital, and not a real-time alert.
The full intended use, warnings and hazard list are on the desk's IFU tab.
FirstPass has no accounts and no database. The desk runs in your browser.
No accounts. There is no sign-up and no sign-in. No database holds learner data.
What stays in your browser. The drugs on your desk, host toggles (smoking, alcohol, age band, kidney, pregnancy, metabolizer picks), any amounts you type, study marks, lab-book answers, saved briefs, recent trays and watch pins are kept in this browser's local storage, not on a FirstPass server. Clearing site data removes them. A license key is also kept there; it is sent to the server once, to check its signature, when you redeem it.
Live sources get drug names only. When you open a live lookup, the browser sends catalog drug ids or names to the FirstPass server. The server then asks public sources by drug name: OpenFDA, NLM RxNorm and RxClass, PubChem, DailyMed, ClinicalTrials.gov, NCBI PubMed, the CPIC API, PsychonautWiki and TripSit. Host toggles and typed amounts are not part of these lookups. Because the server makes the calls, those sources see the server, not your browser.
The three readers use an AI service. Only when you press "Ask the three readers", the server sends a short brief built from the check on screen (drug names, the top rows and their mechanisms, the source name and blank-pair reasons) to xAI's API, which runs a Grok model. Answers are screened for doses and held in server memory for 10 minutes. The readers are off when no xAI key is set.
Payments. Card payments run on Stripe's hosted checkout page, so card numbers never reach FirstPass. Stripe keeps the buyer's email and name. The FirstPass server reads them from Stripe to send the Founding key and writes the key back to the Stripe record. PayPal checkout is built but stays off unless it is configured. Venmo, Cash App and direct PayPal payments are handled by the operator, who issues the key.
Key emails. Founding keys are emailed through Resend to the purchase email, with a blind copy to the FirstPass inbox.
Lost-key recovery. The email you type is checked against Stripe. To limit abuse, the server counts requests by email and IP address in memory. Those counters are lost when that server instance restarts, and they are not written to disk or a database.
No analytics. FirstPass has no analytics, advertising or tracking code. The feedback link opens your own email app.
Outside resources on every page. Pages load fonts from Google Fonts and a "Created with Grok" badge script from grok.com, the platform FirstPass was built with. Those requests show your IP address and browser to Google and to grok.com. FirstPass does not control the grok.com script, and grok.com can set its own cookies. FirstPass's own code sets no cookies.
Do not enter patient information. FirstPass is not built to hold protected health information (PHI). Its terms say users must not enter PHI, and that FirstPass is not a HIPAA covered entity or business associate. Use drug names and teaching toggles only.
Server logs. FirstPass server logs record event names, status, timing and counts. They are written so they never hold request contents, search text, regimens, host toggles or license keys. Vercel, the host, keeps its own request logs.
Signed keys. A license key is checked on the server with HMAC-SHA256 and a secret that never leaves the server. FirstPass keeps no key database: a paid key is derived again from its Stripe payment record, and the key is also written to that Stripe record.
Secrets stay on the server. Stripe, Resend, PayPal, xAI and signing secrets are read from server environment variables. None use the VITE_ prefix that would ship them to the browser, and .env files are kept out of the repository.
Fails closed in production. Without its signing secret or operator PIN, the server refuses to mint or check keys rather than fall back to a default. The Stripe webhook rejects calls without a valid signature. Card checkout, key recovery and the readers switch off when their keys are missing.
Rate limits. Key recovery allows 5 requests per IP address per 15 minutes and 3 per email per hour. The readers allow 30 asks per minute. These counters live in each server instance's memory, so they reset when an instance restarts. Other endpoints have no rate limit of their own. They rely on input checks: lists and text are capped, and unknown drug ids are dropped before any outside call.
HTTPS. The desk is hosted on Vercel and served over HTTPS. Plain HTTP redirects to HTTPS.
No stored learner data. There is no database. Learner work stays in the learner's own browser.
Operator tools. Minting keys and listing paid orders need an operator PIN, which the server checks in constant time.
Certifications. FirstPass has no SOC 2 report and no ISO 27001 certificate. It is not FDA-cleared.
These numbers come from reports that scripts in the repository generate. Each is a snapshot from the day it was run. The full reports give the method and the limits.
Label gold set. 481 drug pairs, each tied to an FDA label statement quoted from DailyMed. The desk is at or above the tier the label supports on 481 of 481. Where the label says contraindicated, the desk says "Avoid together" on 446 of 446. Some pairs are held at that tier by a stored label line, so this shows the desk reproduces those labels. It says nothing about pairs outside the set. Report: label-gold-set.md
FDA interaction table. The desk's enzyme and P-gp roles were compared with FDA's table of example drugs that interact with CYP enzymes and transporters, across 280 drug, target and role pairs. Same role: 97.9% (274 of 280). Same role and FDA strength class: 84.6% (237 of 280). FDA strong inhibitors and inducers: 100% (35 of 35). No direction mismatches. FDA calls its table illustrative, not complete. Report: fda-ddi-agreement.md
Enzyme-only "Avoid together". A scan of all 1,682,695 catalog pairs found 277 "Avoid together" findings that come from the enzyme rules. All 277 carry a label citation. Report: severity-whatif.md
Clinical review. No clinician has reviewed this content yet. A sign-off packet lists every rule that can produce an "Avoid together" or "Serious concern" finding (100 rules), with pair counts, examples, the current source and a blank column for a pharmacist reviewer. Report: signoff-packet.md
Not every finding has an outside source. At the last full count (software 1.14.0, 2026-09-26), 48.9% of findings across all catalog pairs rested only on the desk's own map, with no FDA label, PubMed or CPIC source attached. Giving the contraindicated and major findings a specific outside source comes first. Report: gap-assessment.md
Regulatory self-assessment. An engineering self-assessment of FirstPass against FDA guidance for software that is not a medical device. It is not legal advice and not an FDA determination. Report: gap-assessment.md
A draft Accessibility Conformance Report (VPAT 2.5, WCAG 2.2 edition, dated 2026-10-12) covers the desk and the public pair and drug pages. It is a draft. The owner has not yet verified every row, and no one has tested FirstPass with a screen reader. The full report goes out on request once every row is verified.
Summary. Of 56 Level A and AA rows: 15 Supports, 3 Partially Supports, 29 Not Evaluated and 9 Not Applicable. The report names each partial gap and its planned fix.
Automated checks. axe-core scans at 320 and 1280 pixels wide find 0 violations on the scanned views. Lighthouse accessibility scored 100 on the tested pages.
Keyboard. A keyboard script passes 36 of 36 checks on the core journeys, including search, the desk views and the unlock dialog.
Not done yet. Testing with a screen reader, speech input or switch access, and in browsers other than Chrome. Most Not Evaluated rows wait on that.