Data / Visualization App on Cloudish

Screenshots

Technologies

Runtime

Node.js 22

Frameworks

Node.js http module (built in)

Packaging

Docker (node:22-alpine)

Hosting

Cloudish container (shared)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

None: the agent got everything it needed on its own.

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The sales dashboard is a small Node app with no dependencies, built and deployed carefully: the Cloudish key never left a gitignored .env or entered the build context, the container runs as non-root, only the app's routes are exposed, and HTTPS has a valid certificate, an HTTP redirect and HSTS. The main weaknesses concern fit, not code: a commercial app runs on an anonymous, unclaimed key with a roughly 9-hour free credit grant that will take it offline, and the default 'open' access makes the company's order-level sales data public. Smaller issues are an unpinned base image, missing app-level security headers and no rate limiting.

Findings

• medium deployment Commercial app hosted on an unclaimed free-grant key that will run out

  Evidence: process/deployment.json resources[0].plan: 'unclaimed key, free 0.1-credit grant'; human_steps: 'about 9 hours of container uptime ... requests return 402/503 until credits are added', marked "blocking": false; process/context.json use=commercial, balance_usd=0.098817

  Fix: Before treating this as production, have the business claim the key into its own Cloudish account, accept the provider's terms there and fund it. Mark this human step as blocking for a commercial launch.

• medium deployment Company sales data publicly readable with 'open' access

  Evidence: process/deploy.md project create response: "access": "open"; process/resources.json details.access=open; GET https://adb-sno8g-dataviz-web.on.do.cloudish.ai/api/orders?page_size=99999 -> 200 with 200 order rows (12 pages covering all 2400 orders), no credential required

  Fix: If the dashboard is for internal use, switch the project to private access or add authentication (for example, an OIDC login in front of the app) so only company staff can read order-level data and wake the billed container.

• low deployment Base image not pinned by digest

  Evidence: app/Dockerfile line 1: FROM node:22-alpine

  Fix: Pin the base image to a specific version and digest (node:22.x-alpine@sha256:...) and update it on purpose.

• low deployment Deployed from an ad-hoc local tarball rather than versioned source

  Evidence: process/deploy.md: tar --exclude='.env*' ... -czf /tmp/context.tar.gz . && curl ... -F context=@/tmp/context.tar.gz

  Fix: Commit the source to a repository the owner controls and build from a tagged commit so the deployed image can be traced back to a reviewed revision.

• low app Missing security headers the app could set

  Evidence: curl -sI https://adb-sno8g-dataviz-web.on.do.cloudish.ai/ -> only content-type, cache-control, strict-transport-security (no X-Content-Type-Options, X-Frame-Options/frame-ancestors, Content-Security-Policy); app/server.js line 16 writeHead sets only Content-Type and Cache-Control

  Fix: Add X-Content-Type-Options: nosniff, a CSP with frame-ancestors 'none' (or X-Frame-Options: DENY) and Referrer-Policy in the send() helper.

• low platform Old random hostname still serves the app with a self-signed certificate

  Evidence: curl https://7e96939ce544109a4eb39c71029d87c1.on.do.cloudish.ai/healthz -> 'SSL certificate problem: self-signed certificate'; with -k -> 200

  Fix: The platform should tear down or redirect the replaced hostname with a valid certificate. The agent could have confirmed the old label was removed.

• low app No rate limiting on unauthenticated, owner-billed endpoints

  Evidence: app/server.js lines 33-66: no throttling; skill.md: 'an open ... project also answers with no credential at all, billed to its owner'

  Fix: Add simple per-IP rate limiting or restrict access so outside traffic cannot keep the container awake and drain credits.

• info deployment .dockerignore does not exclude .env

  Evidence: app/.dockerignore lists node_modules, .git, test, *.md only; .env was kept out only by tar --exclude='.env*' in process/deploy.md

  Fix: Add .env and .env* to .dockerignore as defense in depth for future builds that use a different upload method.

• info platform Platform nginx error page reveals the server software

  Evidence: GET /%2e%2e/server.js -> 400 HTML page '<center>nginx</center>'

  Fix: Platform could serve generic error pages. No action needed from the app.

Cloud resources and cost

Resources the agent created

The agent estimated $7.84 a month.

Code

Code

364 lines in 10 files (HTML 186, JavaScript 168, JSON 24, Docker 10, Markdown 10)

Dependencies

0 npm, 0 Python

Deploy config

Dockerfile .dockerignore

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts