API / Backend Service on Cloudish

Screenshots

Technologies

Runtime

Node.js 24

Frameworks

Node.js http module (built in)

Data

SQLite (on a persistent volume)

Packaging

Docker (node:24-slim)

Hosting

Cloudish container (shared) with a persistent volume

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

None: the agent got everything it needed on its own.

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The Notes API is well built: it has no dependencies, uses parameterized SQLite queries on a private persistent volume, isolates notes per key, reads API_KEYS from Cloudish's encrypted secret store, and keeps the Cloudish credential out of the build context and logs. Probes found nothing exposed beyond the app, and it is served only over valid HTTPS. The main weaknesses are in hosting and hardening: the app runs on an unclaimed key with about 9 hours of free credit, so it will stop working unless the owner tops it up; the container runs as root; the base image is an unpinned tag; and the app sets none of its own security headers.

Findings

• medium deployment App runs on an unclaimed key with ~9 hours of free credit

  Evidence: process/deployment.json human_steps: 'The key only has the free 0.1-credit grant, about 9 hours of container runtime... Once it runs out the API returns 402' (marked blocking: false); process/context.json balance_usd 0.099341

  Fix: Have the owner claim the key into their own Cloudish account and add credits (or set up auto top-up) before friends rely on the API, and treat this as a blocking step.

• medium deployment Container runs as root

  Evidence: app/Dockerfile has no USER directive; CMD ["node", "src/server.js"] runs as root in node:24-slim

  Fix: Add `RUN chown node:node /data` and `USER node` (the official node image ships a 'node' user), and make sure the mounted volume is writable by that user.

• low deployment Base image not pinned by digest

  Evidence: app/Dockerfile line 1: FROM node:24-slim

  Fix: Pin the base image by digest, e.g. FROM node:24-slim@sha256:..., and update it on purpose.

• low deployment Deployed from a local tarball, not a repository the owner controls

  Evidence: process/deploy.md: tar ... -czf /tmp/context.tar.gz . then curl -F context=@/tmp/context.tar.gz to https://cloudish.ai/api/v1/projects

  Fix: Commit the source to a repository the owner controls and build from a tagged commit, so the image can be traced back to its source.

• low app Missing security headers set by the app

  Evidence: curl -D - https://adb-9nqjr-api.on.do.cloudish.ai/docs -> only content-type and strict-transport-security (added by the platform); no X-Content-Type-Options, X-Frame-Options/frame-ancestors or Content-Security-Policy

  Fix: Set X-Content-Type-Options: nosniff on all responses, and a restrictive CSP with frame-ancestors 'none' on /docs, in app/src/app.js send() and the /docs handler.

• low app Raw API keys stored as note owner in the database

  Evidence: app/src/app.js line 259: handleV1(req, res, url, key) passes the raw key as owner; line 178 inserts it into notes.owner

  Fix: Store a hash of the key (e.g. SHA-256) or a stable key identifier as the owner, so a leaked database does not expose working credentials.

• low app Requests with invalid keys are not rate-limited

  Evidence: app/src/app.js lines 248-251: the 401 for an unknown key is returned before limiter(key) is called, so key-guessing attempts are unlimited; keys.has(key) is not a constant-time comparison

  Fix: Add a per-IP limit on failed authentication, and compare key hashes with crypto.timingSafeEqual.

• low app Malformed percent-encoded id causes a 500

  Evidence: app/src/app.js line 199: decodeURIComponent(parts[2]) throws URIError on input like /v1/notes/%E0, and the error is turned into a generic 500 (lines 269-270) instead of a 400/404

  Fix: Wrap decodeURIComponent in try/catch and return a 404 or 400 HttpError.

• info app No length limits on title, content or tags

  Evidence: app/src/app.js validateFields (lines 99-129) checks types only; the only bound is the 1 MB body cap (line 32)

  Fix: Add reasonable maximum lengths for title and content and a cap on the number and length of tags.

• info app No sensitive files or debug endpoints exposed

  Evidence: GET /.env, /.git/config, /package.json, /src/app.js, /Dockerfile, /admin, /debug, /server-status -> 404 {"error":"Not found"}

  Fix: None needed.

• info platform HTTPS with HTTP redirect and HSTS

  Evidence: curl -I http://adb-9nqjr-api.on.do.cloudish.ai/health -> 308 to https; certificate CN=adb-9nqjr-api.on.do.cloudish.ai, issuer Let's Encrypt YR2, expires Jan 12 2027; strict-transport-security: max-age=31536000

  Fix: None needed.

Cloud resources and cost

Resources the agent created

The agent estimated $7.84 a month.

Code

Code

594 lines in 10 files (JavaScript 586, JSON 33, Markdown 16, Docker 8)

Dependencies

0 npm, 0 Python

Deploy config

Dockerfile .dockerignore

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts