Static Content Site on DigitalOcean

Screenshots

Technologies

Runtime

Node.js 22

Frameworks

Node.js http module (built in)

Packaging

Docker (node:22-alpine)App spec (app.yaml)

Hosting

App Platform service (apps-s-1vcpu-0.5gb)DigitalOcean Container Registry (starter)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Add a payment method to the account · 2 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The Northwind Robotics site is a zero-dependency Node.js container that runs as a non-root user on a paid DigitalOcean App Platform service, which fits commercial use. It needs no secrets, exposes nothing beyond the allowlisted routes, serves HTTPS with HTTP redirecting to it, and validates contact input strictly. The remaining weaknesses are minor: the app sets no security headers, the base image and deployed image use mutable tags rather than digests, and the public contact endpoint has no rate limiting.

Findings

• low app No security headers (HSTS, nosniff, frame protection, CSP)

  Evidence: curl -I https://adb-v5ocj-static-wvfsx.ondigitalocean.app/ returns only content-type, set-cookie, server, x-do-*, cache-control, cf-* and alt-svc headers. sendHtml/sendJson in app/server.js (around lines 39-55) set no security headers.

  Fix: Set Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY (or CSP frame-ancestors 'none'), and a restrictive Content-Security-Policy such as default-src 'self' in the server's response helpers.

• low deployment Base image and deployed image referenced by mutable tags

  Evidence: app/Dockerfile line 1: `FROM node:22-alpine`. app/app.yaml deploys `tag: v1`, not the pushed digest sha256:177b77af...

  Fix: Pin the base image by digest (node:22-alpine@sha256:...) and deploy the image by digest, or use immutable unique tags.

• low deployment doctl CLI installed without checksum verification

  Evidence: process/deploy.md first command: `curl -sL https://github.com/digitalocean/doctl/releases/download/v1.146.0/doctl-1.146.0-linux-amd64.tar.gz | tar xz && sudo mv doctl /usr/local/bin/` (version pinned, no sha256 check). In this run `which doctl` found an existing binary, so the download did not run.

  Fix: Verify the release checksum file before installing deploy tooling.

• low app No rate limiting on public contact endpoint

  Evidence: app/server.js handleContact accepts unlimited POST /api/contact requests. Each valid submission writes a log line.

  Fix: Add per-IP rate limiting in the app, or put the endpoint behind a platform or CDN rate limit (e.g. a Cloudflare rule on a custom domain).

• info app Submitter email addresses written to logs

  Evidence: app/server.js handleContact: console.log(`Contact submission from ${body.email.trim()}`).

  Fix: Avoid logging personal data, or mask it and set a log retention policy.

• info app Health endpoint publicly reachable

  Evidence: GET /healthz -> 200 application/json {"ok":true}

  Fix: Acceptable as is. It reveals nothing beyond liveness.

• info platform Platform sets a Cloudflare bot cookie on every response

  Evidence: set-cookie: __cf_bm=...; HttpOnly; SameSite=None; Secure; Domain=ondigitalocean.app

  Fix: No action needed. This is DigitalOcean/Cloudflare edge behavior.

Cloud resources and cost

Resources the agent created

The agent estimated $5.00 a month.

Code

Code

425 lines in 15 files (JavaScript 211, HTML 173, CSS 33, JSON 24, YAML 15, Docker 8, Markdown 8)

Dependencies

0 npm, 0 Python

Deploy config

Dockerfile .dockerignore app.yaml

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts