Static Content Site on DigitalOcean

Screenshots

Technologies

Runtime

Node.js 22

Frameworks

Node.js http module (built in)

Packaging

Docker (node:22-alpine)App spec (app.yaml)

Hosting

App Platform service (apps-s-1vcpu-0.5gb)DigitalOcean Container Registry (starter)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Add a payment method to the account · 2 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The Northwind Robotics site is a dependency-free Node.js container running as non-root on a paid, always-on DigitalOcean App Platform service, which fits commercial use. It handles no secrets, serves only allow-listed paths over valid HTTPS with an HTTP-to-HTTPS redirect, and validates contact input with a body size cap. The weaknesses are minor: unpinned build inputs (floating base image tag, a mutable `v1` deploy tag, doctl installed without checksum checks), no security headers set by the app, and no rate limiting on the public contact endpoint.

Findings

• low deployment Base image not pinned by digest

  Evidence: app/Dockerfile:1 `FROM node:22-alpine`

  Fix: Pin the base image by digest (node:22-alpine@sha256:...) and update it on purpose.

• low deployment Deployed image referenced by mutable tag

  Evidence: app/app.yaml image `tag: v1`; process/resources.json spec has tag v1 and no digest, although the push printed sha256:d4ef4192... (process/deploy.md)

  Fix: Deploy by image digest, or use unique immutable tags such as the git SHA, so production is tied to a specific build.

• low deployment doctl installed without checksum verification

  Evidence: process/deploy.md: `curl -sL https://github.com/digitalocean/doctl/releases/download/v1.146.0/doctl-1.146.0-linux-amd64.tar.gz | tar xz && sudo mv doctl /usr/local/bin/`

  Fix: Check the release checksum file before installing, or use a package manager that verifies signatures.

• low app Missing security headers

  Evidence: `curl -sI https://adb-fe53v-static-rvzm5.ondigitalocean.app/` returns only content-type, cache-control and Cloudflare/DO headers: no Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options/frame-ancestors or Content-Security-Policy; server.js:85 sets only Content-Type

  Fix: Set HSTS, `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY` (or CSP frame-ancestors) and a strict CSP (`default-src 'self'`) in the Node server.

• low app No abuse protection on public contact endpoint

  Evidence: server.js:32-57 handles POST /api/contact with no rate limit or bot check; repeated valid posts return {"ok":true}

  Fix: Add a per-IP rate limit (in-app or via the platform/CDN) and a honeypot field or similar spam control.

• info app Submitter emails written to platform logs

  Evidence: server.js:54 `console.log(`Contact submission from ${body.email.trim()}`)`

  Fix: Don't log personal data unless needed, or mask it and set log retention to match the privacy policy.

• info deployment Account details printed in deploy transcript

  Evidence: process/deploy.md first command: `curl ... /v2/account | head -c 400` printed the account email and team UUID (the token itself stayed in an env var and was not shown)

  Fix: Avoid dumping account metadata into logs. Use `doctl account get --format Status` when you only need to check the account works.

Cloud resources and cost

Resources the agent created

The agent estimated $5.00 a month.

Code

Code

391 lines in 15 files (JavaScript 181, HTML 165, CSS 36, JSON 24, YAML 15, Docker 9, Markdown 8)

Dependencies

0 npm, 0 Python

Deploy config

Dockerfile .dockerignore app.yaml

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts