Data / Visualization App on Render

Screenshots

Technologies

Runtime

Node.js 22

Frameworks

Node.js http module (built in)

Packaging

Render Blueprint (render.yaml)

Hosting

Render web service (free, running the prebuilt image node:22-alpine)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup

Stack fit

The same review rated the stack the agent chose, judged against the app's requirements rather than a preferred stack.

A zero-dependency Node server with in-memory CSV aggregation and vanilla SVG charts fits this small read-only dashboard well and matches the reasoning in STACK.md. The deployment departed from the planned Git-backed native Node service and runs as an image-backed workaround on a sleeping free instance.

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

A small, zero-dependency Node dashboard with careful input validation, an allowlist for static files, and no secrets to leak. Its weaknesses are in the deployment: a commercial app runs on Render's sleeping free tier, the code is shipped as a tarball in a Render secret file on a floating node:22-alpine tag rather than built from an owned repo, and the container runs as root with no security headers.

Findings

• medium deployment Commercial app on Render free instance that sleeps

  Evidence: process/resources.json: plan "free"; process/context.json: use "commercial"; process/deployment.json notes: "The free plan spins the service down after about 15 minutes idle, so the first request after that takes about 30-60 seconds."

  Fix: Move the service to a paid instance type (e.g. Starter) so it stays up and runs under production-grade terms.

• medium deployment App code delivered as a secret-file tarball instead of a source-controlled build

  Evidence: app/scripts/deploy.sh: git archive -> base64 -> secretFiles 'app.tgz.b64'; app/scripts/render-boot.js unpacks /etc/secrets/app.tgz.b64 into /tmp/app and requires server.js

  Fix: Push the repo to a Git provider the owner controls and deploy with the included render.yaml (native Node runtime), or build and push a versioned image to an owned registry.

• low deployment Base image not pinned to a digest

  Evidence: app/scripts/deploy.sh: "imagePath": "docker.io/library/node:22-alpine" (floating tag; Render pulls whatever the tag points to on each deploy)

  Fix: Pin the image as node:22-alpine@sha256:<digest> and update it on purpose.

• low deployment Container process runs as root

  Evidence: app/scripts/deploy.sh: dockerCommand 'node /etc/secrets/boot.js' on node:22-alpine, whose default user is root; nothing switches to the 'node' user

  Fix: Run as the image's unprivileged 'node' user (custom image with USER node), or use Render's native Node runtime.

• low app No security headers

  Evidence: GET https://adb-zvm8n-dataviz-web.onrender.com/ response headers: content-type, rndr-id, server: cloudflare, vary, x-render-origin-server, cf-cache-status, cf-ray, alt-svc; no Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options or Content-Security-Policy. app/server.js writeHead sets only Content-Type/Cache-Control.

  Fix: In server.js, add HSTS, X-Content-Type-Options: nosniff, X-Frame-Options: DENY (or CSP frame-ancestors 'none'), and a strict CSP (default-src 'self').

• info app Health endpoint is public

  Evidence: GET /healthz -> 200 {"status":"ok","rows":2400}

  Fix: Acceptable. Optionally return only {status:'ok'}.

• info app No rate limiting on public API

  Evidence: app/server.js: /api/summary and /api/orders are served without any throttling; GET /api/orders?limit=100000&offset=-5 -> 200 with limit clamped to 500, offset 0

  Fix: Low risk for in-memory aggregation of 2,400 rows. Add simple per-IP limits if traffic grows.

Cloud resources and cost

Resources the agent created

The agent estimated $0.00 a month.

Code

Code

636 lines in 15 files (JavaScript 434, CSS 82, HTML 66, Shell 54, Markdown 26, JSON 21, YAML 13)

Dependencies

0 npm, 0 Python

Deploy config

render.yaml

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts