API / Backend Service on DigitalOcean

Screenshots

Technologies

Runtime

Python 3.12

Frameworks

FastAPI

Data

PostgreSQL (App Platform dev database)

Libraries

UvicornpsycopgSQLAlchemy

Dev tools

HTTPXpytest

Packaging

Docker (python:3.12-slim)App spec (.do/app.yaml)

Hosting

App Platform service (apps-s-1vcpu-0.5gb)DigitalOcean Container Registry (starter)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Add a payment method to the account · 2 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup

Stack fit

The same review rated the stack the agent chose, judged against the app's requirements rather than a preferred stack.

Python/FastAPI with SQLAlchemy Core on App Platform plus an attached Postgres dev database is a well-proportioned, idiomatic fit for a small authenticated JSON API, and STACK.md explains the choice soundly. The build matches the documented decision.

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The Notes API is a small, cleanly built FastAPI service on paid DigitalOcean App Platform with an attached Postgres dev database. API keys are stored as an encrypted platform secret, the container runs as non-root, it is served only over HTTPS, and probing found no exposed files, debug endpoints or stack traces. The remaining weaknesses are minor: the base image and transitive dependencies are not pinned, security headers are missing, the dev database is internet-reachable, and malformed bodies get 400 before the auth check, so unauthenticated requests are never rate-limited.

Findings

• low deployment Base image and transitive dependencies not pinned

  Evidence: app/Dockerfile:1 `FROM python:3.12-slim` (no @sha256 digest); app/requirements.txt pins only fastapi, uvicorn, sqlalchemy and psycopg, with no lockfile or --require-hashes; the spec references a tag (resources.json image.tag 20261014234806), not a digest

  Fix: Pin the base image by digest, generate a fully locked requirements file with hashes (pip-compile --generate-hashes), and reference the image by digest in the app spec.

• low platform Dev database is publicly reachable and has no trusted-source restriction

  Evidence: app/.do/app.yaml databases: `production: false` (App Platform dev database); dev databases cannot have trusted sources configured, so the endpoint is reachable from the internet and protected only by TLS and credentials

  Fix: For stronger isolation, use a managed database cluster with trusted sources limited to the app (or VPC). Optionally use a least-privileged role for the app.

• low app No security headers (HSTS, nosniff, frame protection, CSP)

  Evidence: GET https://adb-5e3ks-api-omhxz.ondigitalocean.app/health and /docs: response headers include only content-type, server: cloudflare, cache-control: private, cf-* and alt-svc. There is no strict-transport-security, x-content-type-options, x-frame-options or content-security-policy.

  Fix: Add a small middleware that sets HSTS, X-Content-Type-Options: nosniff, X-Frame-Options: DENY and a restrictive CSP (especially for the /docs HTML page).

• low app Body validation runs before authentication; unauthenticated requests are not rate-limited

  Evidence: POST /v1/notes with `X-API-Key: bogus` and body `{bad` returned `HTTP/2 400 {"error":"1: JSON decode error"}` instead of 401. app/app/main.py:122-131 checks the key and rate limit only inside the dependency, which runs after body parsing, and 401s are never counted.

  Fix: Do API-key checks (and an IP-based limit for failed auth) in middleware before body parsing, so unauthenticated callers always get 401 and cannot hammer the endpoint for free.

• info app API key compared without constant-time comparison, and no per-key storage quota

  Evidence: app/app/main.py:124-125 `x_api_key not in valid` (set membership); app/app/db.py has no limit on the number of notes per owner (each note can be up to 100,000 chars of content)

  Fix: Compare keys with hmac.compare_digest, and cap notes per key so a leaked key cannot fill the 512 MB-class dev database.

• info app Rate limiter is in-memory and per instance

  Evidence: app/app/ratelimit.py:12-13 keeps hits in a process-local dict; deployment.json notes say to keep instance_count at 1. Limits reset on every redeploy or restart.

  Fix: Acceptable at one instance. Move to a shared store (e.g. Managed Valkey) or Postgres if the app ever scales out.

• info deployment Dev database has limited durability guarantees

  Evidence: process/deployment.json: `PostgreSQL 16 (App Platform dev database ...) plan: dev database (production: false)`

  Fix: For a personal side project this is fine. Upgrade to a managed cluster if friends' data needs backups and point-in-time recovery.

Cloud resources and cost

Resources the agent created

The agent estimated $12.00 a month.

Code

Code

449 lines in 16 files (Python 387, Shell 52, Markdown 48, YAML 29, JSON 11, Docker 10)

Dependencies

0 npm, 6 Python

Deploy config

Dockerfile .dockerignore .do/app.yaml

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts