Static Content Site on Render

Screenshots

Technologies

Runtime

Node.js 18+

Frameworks

Node.js http module (built in)

Packaging

Render Blueprint (render.yaml)

Hosting

Render web service (free, built from render-examples/express-hello-world)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The Northwind Robotics site is a small, dependency-free Node server on Render: allowlisted routes, solid input validation, HTTPS with an HTTP-to-HTTPS redirect, and no leaked secrets or exposed files. The main weaknesses are provenance and compliance: Render records the service's source as a third-party example repo, while the code that actually runs is an opaque base64 tarball in an env var, and a commercial site is hosted on a free plan that sleeps when idle. Minor gaps are the missing security headers and no rate limiting on the contact endpoint.

Findings

• medium deployment Service built from third-party repo; real code smuggled in via env-var tarball

  Evidence: process/deploy.md: POST /v1/services body sets "repo":"https://github.com/render-examples/express-hello-world","branch":"main" and buildCommand "find . -mindepth 1 -maxdepth 1 ! -name .git -exec rm -rf {} + && echo \"$APP_TGZ_B64\" | base64 -d | tar xz && npm install"; process/resources.json source=https://github.com/render-examples/express-hello-world

  Fix: Push the app to a repository the owner controls and point the Render service at it, pinned to a branch or commit, with auto-deploy from that repo. Alternatively, deploy a pinned, digest-referenced image from an owner-controlled registry. Remove the APP_TGZ_B64 mechanism.

• medium deployment Commercial site on Render free tier that sleeps when idle

  Evidence: process/context.json use=commercial; process/resources.json plan=free; process/deployment.json notes: 'Free instances sleep after ~15 min idle, so the first request after that can take ~30-60s'

  Fix: Use a paid instance type (e.g. Starter) for a business's public site so it stays up and runs under production-appropriate terms, or host the static pages on Render Static Sites with the API on a paid instance.

• low deployment Node runtime pinned only to a major version

  Evidence: process/deploy.md envVars: {"key":"NODE_VERSION","value":"22"}; app/package.json engines "node": ">=18"

  Fix: Pin an exact Node version (e.g. 22.x.y) through NODE_VERSION or .node-version so builds are reproducible.

• low app No security headers (HSTS, nosniff, frame protection, CSP)

  Evidence: curl -sI https://adb-1ywvf-static-web.onrender.com/ -> only content-type, rndr-id, server: cloudflare, vary, x-render-origin-server, cf-* headers; app/server.js send() sets only Content-Type, Content-Length and extra headers

  Fix: Add Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY (or CSP frame-ancestors 'none'), a restrictive Content-Security-Policy (default-src 'self') and Referrer-Policy in send().

• low app Contact endpoint has no rate limiting or anti-spam control

  Evidence: app/server.js handleContact(): accepts every valid POST and logs it; POST /api/contact with {"name":"<script>","email":"a@b.co","message":"x"} -> 200 {"ok":true}

  Fix: Add simple per-IP rate limiting and a honeypot field or similar bot check.

• info app User input written to logs unsanitized

  Evidence: app/server.js line ~52: console.log(`Contact submission from ${data.name.trim()} <${data.email.trim()}>`) – name may contain newlines/control chars

  Fix: Strip control characters, or log structured JSON (JSON.stringify) so user input can't forge log lines.

• info app Allowlisted routing; no sensitive files exposed

  Evidence: GET /.env, /.git/config, /package.json, /server.js, /render.yaml, /deploy.sh -> 404; /healthz -> 200 'ok'

  Fix: None required.

Cloud resources and cost

Resources the agent created

The agent estimated $0.00 a month.

Code

Code

344 lines in 14 files (JavaScript 163, HTML 136, CSS 33, JSON 21, Shell 12, YAML 8, Markdown 6)

Dependencies

0 npm, 0 Python

Deploy config

render.yaml

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts