Database-Backed CRUD App on Vercel

Screenshots

Technologies

Runtime

Node.js 24

Frameworks

Express

Data

Vercel Blob

Libraries

Vercel Blob SDKnode-postgresbcrypt.js

Packaging

vercel.json

Hosting

Vercel projectVercel Functions

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The app itself is solid: bcrypt passwords, hashed 256-bit session tokens, every todo scoped to its owner, a private Blob store, and the secret read from Vercel environment variables, with HTTPS/HSTS from the platform. The biggest problem is compliance: a commercial app is hosted on Vercel's Hobby plan, which is limited to non-commercial use. The deployment also serves all server-side source files publicly (/src/app.js, /server.js, /src/store/*), and smaller gaps include no auth rate limiting, missing security headers and an unpinned CLI-upload deploy.

Findings

• high deployment Commercial app hosted on Vercel Hobby (personal, non-commercial plan)

  Evidence: process/context.json: "use": "commercial", team_plans: {"team_U2tHOV4fpUx18nl9EpcRQ4hO": "hobby"}; process/deployment.json resources[0].plan: "Hobby (free)". Vercel's Hobby plan is limited to personal, non-commercial use under its fair-use and terms rules.

  Fix: Move the project to a Vercel Pro (or Enterprise) team before using it for a business, or pick a provider and plan that allows commercial use. Flag the plan restriction to the owner in deployment.json.

• medium deployment Server-side source code publicly served as static files

  Evidence: GET https://adb-fbt4r-crud.vercel.app/src/app.js -> 200 application/javascript (full Express app); /server.js -> 200; /src/store/blob.js, /src/store/pg.js, /src/store/pg-pool.js, /src/store/index.js -> 200. vercel.json only rewrites /(.*) -> /api, and Vercel serves filesystem files before applying rewrites. .vercelignore excludes only .env*, node_modules, test, TASK.md and deployment.json.

  Fix: Move server code out of the publicly served root (for example lib/ referenced only through includeFiles), set an empty public output directory, or add src/ and server.js to .vercelignore and bundle them into the function. Then check that /src/app.js returns 404.

• low app No rate limiting on authentication endpoints

  Evidence: app/src/app.js POST /api/auth/login and /api/auth/signup have no throttling. Six consecutive failed logins for the same email all returned 401 with no slowdown or lockout.

  Fix: Add per-IP and per-account rate limiting (for example Vercel WAF rate-limit rules or a KV-backed limiter) on login and signup.

• low app Missing security headers (CSP, X-Content-Type-Options, frame protection)

  Evidence: curl -sI https://adb-fbt4r-crud.vercel.app/ returns only strict-transport-security among security headers. There is no content-security-policy, x-content-type-options or x-frame-options. app/src/app.js sets no headers apart from disabling x-powered-by.

  Fix: Set Content-Security-Policy (including frame-ancestors 'none'), X-Content-Type-Options: nosniff and Referrer-Policy through helmet or a headers block in vercel.json.

• low deployment Unpinned deploy tooling and deployment from a local upload

  Evidence: process/deploy.md: every deploy ran `npx -y vercel@latest ... deploy --prod --yes` from the local directory, with no git integration. app/package.json uses caret ranges ("express": "^5.3.0", "@vercel/blob": "^2.8.1"). The build restored a cache from an earlier deployment.

  Fix: Deploy from a git repository the owner controls through Vercel's Git integration, pin the Vercel CLI version, commit package-lock.json and use npm ci.

• low deployment Blob read-write token exposed to Preview and Development environments

  Evidence: process/deploy.md `vercel env ls`: BLOB_READ_WRITE_TOKEN ... environments: Production, Preview, Development. The production data store is reachable from preview builds and from the local .env.local the CLI pulled.

  Fix: Limit the production store token to the Production environment and give preview/development a separate store.

• low app Postgres TLS certificate verification disabled

  Evidence: app/src/store/pg-pool.js: ssl: { rejectUnauthorized: false } for non-local connection strings. This path is unused in the current Blob deployment but would be active once DATABASE_URL is set.

  Fix: Verify the server certificate (rejectUnauthorized: true, with the provider CA if needed).

• info deployment Token prefix printed in transcript; Vercel token passed on the command line

  Evidence: process/deploy.md line ~430: `vercel env ls` output shows `BLOB_READ_WRITE_TOKEN eyJ2IjoidjIiLCJjIj…` (a truncated, non-usable prefix). Commands pass `--token $VERCEL_TOKEN` as an argument. Neither exposes a complete secret.

  Fix: Use the VERCEL_TOKEN environment variable instead of --token, and don't print environment listings into logs.

• info app Health endpoint discloses storage backend

  Evidence: GET /api/health -> 200 {"ok":true,"storage":"vercel-blob"}

  Fix: Return only {ok:true} publicly, or require auth for diagnostic details.

• info app Session token stored in localStorage

  Evidence: app/src/index.html lines 51 and 67: localStorage.getItem/setItem('token'). Any XSS would expose the token, though titles are rendered with textContent and a stored '<img onerror>' title is inert.

  Fix: Consider an HttpOnly, Secure, SameSite cookie for the web UI, together with a CSP.

Cloud resources and cost

Resources the agent created

The agent estimated $0.00 a month.

Code

Code

593 lines in 15 files (JavaScript 462, HTML 131, JSON 44, Markdown 25)

Dependencies

4 npm, 0 Python

Deploy config

vercel.json

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts