Data / Visualization App on Cloudish

Screenshots

Technologies

Runtime

Node.js 22

Frameworks

Node.js http module (built in)

Packaging

Docker (node:22-alpine)

Hosting

Cloudish container (shared)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

None: the agent got everything it needed on its own.

Stack fit

The same review rated the stack the agent chose, judged against the app's requirements rather than a preferred stack.

A zero-dependency Node.js server with in-memory CSV aggregation and vanilla SVG charts in a single small container is a well-proportioned fit for a read-only dashboard on a container platform like Cloudish, and it matches the reasoning recorded in STACK.md.

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

A clean, zero-dependency Node.js container built by Cloudish from the agent's Dockerfile. It runs as a non-root user and is served only over HTTPS with a valid certificate. The API key was handled carefully and never leaked, and nothing beyond the app is exposed. The main weakness is the hosting: a commercial app on an unclaimed agent key whose free 0.1-credit grant lasts about 9 hours before the site starts returning 402/503. Smaller issues are the unpinned base image tag and missing app-set security headers.

Findings

• medium deployment Commercial app runs on an unclaimed free-grant key that runs out in about 9 hours

  Evidence: process/deployment.json human_steps: 'The free grant is 0.1 credits, about 9 hours of running time ... After that, requests get 402/503'; process/context.json account.balance_usd 0.098104; deploy.md key creation via POST /api/v1/keys (unclaimed, alias adb-3yi98-dataviz)

  Fix: Have the business claim the key (or deploy under its own funded Cloudish account) and add enough credit before relying on the dashboard. Treat this as blocking for a commercial launch.

• low deployment Base image pinned only to a floating tag

  Evidence: app/Dockerfile:1 'FROM node:22-alpine'

  Fix: Pin the base image by digest (node:22-alpine@sha256:...) and update it deliberately.

• low deployment Deployed from a local tarball under an agent-owned account, not an owner-controlled source

  Evidence: deploy.md: tar -czf /tmp/context.tar.gz ... ; curl -X POST https://cloudish.ai/api/v1/projects -F context=@/tmp/context.tar.gz (owner id 88, unclaimed key)

  Fix: Keep the source in a repository the owner controls and deploy from it (or a tagged commit) under the owner's claimed account.

• low app Missing CSP, X-Content-Type-Options and frame protection headers

  Evidence: curl -sI https://adb-3yi98-dataviz-web.on.do.cloudish.ai/ returns only content-type, content-length, cache-control and strict-transport-security; app/server.js:14 sets only Content-Type, Content-Length and Cache-Control

  Fix: Add Content-Security-Policy (default-src 'self'), X-Content-Type-Options: nosniff and X-Frame-Options: DENY / frame-ancestors 'none' in send().

• low platform Scale-to-zero adds cold starts

  Evidence: process/deployment.json notes: 'the app sleeps after 15 minutes without requests ... cold start takes a few seconds'

  Fix: Acceptable for a small internal dashboard. If first-load latency matters, keep a minimum replica warm once the account is funded.

• info app Date filters validated by shape only

  Evidence: GET /api/summary?start=2025-13-99 -> 200 with zero results; app/data.js:4 DATE_RE = /^\d{4}-\d{2}-\d{2}$/

  Fix: Also check that the date is a real calendar date and return 400 if not.

• info app No rate limiting on public API

  Evidence: app/server.js:18-43 has no throttling. Each request filters 2,400 in-memory rows, so the cost is very low.

  Fix: Optional: add a simple per-IP limit or rely on platform ingress limits if traffic grows.

• info app Public health endpoint reveals row count

  Evidence: GET /healthz -> 200 {"status":"ok","rows":2400}

  Fix: Return just {status:'ok'}. This is harmless here.

• info platform Ingress error page identifies nginx

  Evidence: GET /..%2fserver.js -> 400 nginx-branded HTML page

  Fix: No action for the agent. The platform could serve a neutral error page.

Cloud resources and cost

Resources the agent created

The agent estimated $7.84 a month.

Code

Code

471 lines in 11 files (HTML 270, JavaScript 192, Markdown 26, JSON 25, Docker 9)

Dependencies

0 npm, 0 Python

Deploy config

Dockerfile .dockerignore

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts