Real-Time Collaborative App on DigitalOcean

Screenshots

Technologies

Runtime

Node.js 22

Frameworks

Node.js http module (built in)

Libraries

ws

Packaging

Docker (node:22-alpine)App spec (.do/app.yaml)

Hosting

App Platform service (apps-s-1vcpu-0.5gb)DigitalOcean Container Registry (starter)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Add a payment method to the account · 2 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

A small, carefully built Node/ws chat app on a paid DigitalOcean App Platform Basic instance. The app needs no secrets, the container runs as non-root, nothing beyond the app is exposed, HTTPS is enforced, and the hosting fits personal use. The main weaknesses are provenance (an unpinned base image, a mutable v1 image tag, and builds pushed from the agent's local workspace), plus minor app-level gaps: no security headers, no rate limiting, unbounded in-memory room creation, and no Origin check on WebSocket upgrades.

Findings

• medium deployment Base image and deployed image not pinned by digest

  Evidence: app/Dockerfile:1 `FROM node:22-alpine`; app/.do/app.yaml uses `tag: v1` (process/resources.json image.tag "v1"), a mutable tag that can be overwritten in DOCR

  Fix: Pin the base image as node:22-alpine@sha256:<digest> and deploy the pushed image by digest (image.digest in the app spec), or use unique immutable tags.

• medium app Unbounded room creation and no rate limiting

  Evidence: server.js:19-26 getRoom() inserts a new room into the global Map for any valid name, and it is called even on GET /api/rooms/<room>/messages (server.js:131) and for SSE connections; rooms are never removed, and there is no per-client limit on POSTs, WebSocket messages or connections

  Fix: Create rooms only when messages are posted, evict empty rooms, cap the room count, and add per-IP rate limits on posts, WebSocket messages and connections.

• low deployment Built from local workspace with no source-controlled pipeline

  Evidence: process/deploy.md: `docker build ... -t registry.digitalocean.com/adb-wf7uo-realtime/adb-wf7uo-realtime-web:v1 . && docker push` run from the agent's machine; no git repository or CI involved

  Fix: Build and deploy from a repository the owner controls (App Platform GitHub source, or a CI pipeline that pushes digest-tagged images).

• low deployment Deploy tool downloaded without integrity verification

  Evidence: process/deploy.md: `curl -sL https://github.com/digitalocean/doctl/releases/download/v1.146.0/doctl-1.146.0-linux-amd64.tar.gz | tar xz && sudo mv doctl /usr/local/bin/`, with no checksum check

  Fix: Verify the release checksum file, or install doctl from a signed package source.

• low app No security headers

  Evidence: GET https://adb-wf7uo-realtime-5cs45.ondigitalocean.app/?room=general returns only content-type, cache-control and the platform/Cloudflare headers: no Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options/frame-ancestors or Content-Security-Policy (server.js:112)

  Fix: Set HSTS, X-Content-Type-Options: nosniff, a CSP with frame-ancestors 'none', and Referrer-Policy in sendJson and the index handler.

• low app WebSocket upgrade does not check Origin

  Evidence: server.js:184-199 accepts upgrades without inspecting the Origin header; an upgrade request with `Origin: https://evil.example` to /ws?room=review&user=rev returned 101

  Fix: Reject upgrades whose Origin is not the app's own host, so third-party pages can't open sockets for visitors.

• info deployment Dependencies installed from lockfile

  Evidence: app/Dockerfile:4-5 `COPY package*.json ./` and `RUN npm ci --omit=dev`; the only runtime dependency is ws ^8.22.0 (app/package.json)

  Fix: No action needed; keep committing package-lock.json.

• info app Output encoding prevents XSS

  Evidence: app/public/index.html:74-75 builds messages with createElement/textContent; a POST with user `<img src=x>` and blank text was rejected 400 by validText (server.js:39-41)

  Fix: No action needed.

• info deployment Container runs as non-root

  Evidence: app/Dockerfile:10 `USER node`

  Fix: No action needed.

• info app No sensitive files or debug endpoints exposed

  Evidence: GET /.env, /.git/config, /package.json, /server.js, /Dockerfile and /admin all returned 404 {"error":"not found"}; server.js:170 is a catch-all 404, and server.js:177 returns a generic 500

  Fix: No action needed.

• info deployment No secrets required or leaked

  Evidence: process/deploy.md uses the token only as `$DIGITALOCEAN_ACCESS_TOKEN` in curl headers; app/.do/app.yaml has no envs; .dockerignore excludes .git and .env is gitignored

  Fix: No action needed; add .env to .dockerignore as well, as defense in depth.

Cloud resources and cost

Resources the agent created

The agent estimated $5.00 a month.

Code

Code

486 lines in 10 files (JavaScript 345, HTML 130, JSON 29, Markdown 16, YAML 16, Docker 11)

Dependencies

1 npm, 0 Python

Deploy config

Dockerfile .dockerignore .do/app.yaml

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts