Data / Visualization App on Cloudish

Screenshots

Technologies

Runtime

Node.js 22

Frameworks

Node.js http module (built in)

Packaging

Docker (node:22-alpine)

Hosting

Cloudish container (shared)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

None: the agent got everything it needed on its own.

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The agent built a small, dependency-free Node dashboard that runs as non-root, handles its one credential carefully, serves only allowlisted files over valid HTTPS with HSTS, and validates its inputs. The main weakness is fit for purpose: a business's app runs on an unclaimed $0.10 free credit grant that the agent says will fail with 402/503 after about 9 hours, yet it marked funding as non-blocking. Smaller issues are an unpinned base image, no source repository, missing app-level security headers, and permissive CORS added by the platform.

Findings

• medium deployment Business app runs on an unclaimed free credit grant that runs out in hours

  Evidence: process/deployment.json: plan "unclaimed key, free 0.1 credit grant"; human_steps says the grant "covers about 9 hours of running time ... After that, requests return 402/503" but marks it "blocking": false. process/context.json: use "commercial", balance_usd 0.098981.

  Fix: Have the business claim the key under its own Cloudish account, accept the terms and add billing before go-live. Treat this as a blocking step, not an optional one.

• low deployment Scale-to-zero gives a cold start on the first request after idle

  Evidence: process/deployment.json notes: "the default idle timeout scales it to zero when there's no traffic ... After idling, the first request has a cold start"; process/deploy.md shows the app returning 000 at first while it started.

  Fix: If the dashboard needs to respond quickly at all times, raise the idle timeout or keep one replica always on once billing is in place.

• low deployment Base image not pinned to a digest

  Evidence: app/Dockerfile line 1: FROM node:22-alpine

  Fix: Pin the base image by digest (node:22-alpine@sha256:...) and update it on purpose.

• low deployment Deployed from a local tarball, with no source repository the owner controls

  Evidence: process/deploy.md: tar ... -czf /tmp/context.tar.gz . then POST /api/v1/projects -F context=@/tmp/context.tar.gz; the agent's git status returned "fatal: not a git repository"

  Fix: Commit the source to a repository the owner controls and build from a tagged commit, so the deployed image can be traced back to reviewed code.

• low platform Ingress reflects any Origin with credentials allowed

  Evidence: curl -H 'Origin: https://evil.example' /api/summary -> access-control-allow-origin: https://evil.example, access-control-allow-credentials: true; OPTIONS preflight -> access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE. app/src/server.js sets no CORS headers.

  Fix: The platform should leave CORS to the app or default to same-origin. Impact here is low because the app has no cookies or auth and only answers GET/HEAD (POST returns 405).

• low app Missing X-Content-Type-Options, frame protection and CSP

  Evidence: curl -sI https://adb-mq202-dataviz-web.on.do.cloudish.ai/ returns only content-type, vary, CORS headers and strict-transport-security; app/src/server.js lines 21-22 and 45 set only Content-Type and Cache-Control.

  Fix: Set X-Content-Type-Options: nosniff, Content-Security-Policy (default-src 'self'; frame-ancestors 'none') and Referrer-Policy in the Node server's responses.

• low app No rate limiting on public API endpoints

  Evidence: app/src/server.js lines 33-41: /api/summary and /api/orders filter and sort all rows on every request with no throttling; GET /api/orders?limit=999999 -> 200 with limit capped at 500.

  Fix: Add simple per-IP rate limiting or caching of summary results. The dataset is small, so the risk is mainly cost from unbounded scale-up, not outage.

• info app Company order data is public with no authentication

  Evidence: GET /api/orders -> 200 {"total":2400,...} with no credentials; access "open" in process/resources.json

  Fix: The task didn't require auth, but if the sales data is internal, put the dashboard behind authentication or the platform's access controls.

• info deployment API key handled without exposure

  Evidence: process/deploy.md: key written via jq to .env with chmod 600 and never echoed; tar --exclude='.env*' context listing shows no .env; .dockerignore and .gitignore list .env; docker env {}

  Fix: No change needed. Rotate the key once it is claimed if the build host is shared.

Cloud resources and cost

Resources the agent created

The agent estimated $7.84 a month.

Code

Code

492 lines in 12 files (JavaScript 369, CSS 64, HTML 49, JSON 24, Docker 10, Markdown 8)

Dependencies

0 npm, 0 Python

Deploy config

Dockerfile .dockerignore

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts