Data / Visualization App on DigitalOcean

Screenshots

Technologies

Runtime

Node.js 20

Frameworks

Express

Libraries

Chart.js

Packaging

Docker (node:20-alpine)App spec (.do/app.yaml)

Hosting

App Platform service (apps-s-1vcpu-0.5gb)DigitalOcean Container Registry (starter)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Add a payment method to the account · 2 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup

Stack fit

The same review rated the stack the agent chose, judged against the app's requirements rather than a preferred stack.

Express with the data in memory, Chart.js served locally, and one App Platform service is a simple, well-reasoned stack for a small read-only dashboard. The one departure from STACK.md is a Dockerfile built locally and pushed to DOCR instead of an App Platform source build.

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The dashboard runs on a paid, always-on App Platform service with a private DOCR image. It needs no secrets, and no credentials leaked during build or deploy. HTTPS is enforced and nothing beyond the app is exposed. The main weaknesses are in the deployment: an unpinned node:20-alpine base image, deploying from a mutable :latest tag built on the agent's machine, a container that runs as root, and missing security headers.

Findings

• medium deployment Deployed from mutable :latest tag with unpinned base image

  Evidence: app/.do/app.yaml lines 5-9 (tag: latest); app/Dockerfile line 1 'FROM node:20-alpine'; scripts/deploy.sh builds and pushes registry.digitalocean.com/$REG/$REPO:latest

  Fix: Pin the base image by digest (node:20-alpine@sha256:...). Tag each image with an immutable version (git SHA) or deploy by digest, and build from a version-controlled source (App Platform git source or CI).

• medium deployment Container runs as root

  Evidence: app/Dockerfile has no USER directive; node:20-alpine runs as root by default

  Fix: Add 'USER node' (and copy files with --chown=node:node) so the server runs unprivileged.

• low deployment Lock file not part of delivered sources

  Evidence: Dockerfile runs 'npm ci --omit=dev' (needs package-lock.json, which appears in the build transcript's ls output), but app/ contains no package-lock.json; package.json uses caret ranges ^4.5.1 / ^4.22.3

  Fix: Commit package-lock.json alongside the source so the dependency set used in production can be reproduced and audited.

• low app Missing security headers

  Evidence: curl -sI https://adb-ankp0-dataviz-4fbum.ondigitalocean.app/ returns no Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options/frame-ancestors or Content-Security-Policy

  Fix: Add helmet (or set the headers manually) with HSTS, nosniff, frame-ancestors 'none' and a strict CSP ('self' only, since Chart.js is served locally).

• low app Framework fingerprinting via X-Powered-By

  Evidence: Every response includes 'x-powered-by: Express'; unknown paths return Express's default 'Cannot GET /path' page

  Fix: Call app.disable('x-powered-by') and add a minimal custom 404 handler.

• low app Impossible calendar dates accepted

  Evidence: GET /api/summary?start=2025-02-31 -> 200 (filtered from 2025-03). In lib/data.js parseFilters, the check is the regex plus Date.parse, which rolls over invalid days

  Fix: Check that the parsed date round-trips (new Date(s).toISOString().slice(0,10) === s) and return 400 otherwise.

• low app No rate limiting on public API

  Evidence: server.js: /api/summary and /api/orders (up to 500 rows per request, e.g. GET /api/orders?limit=99999 -> 77 KB response) have no throttling

  Fix: Add a lightweight per-IP limiter such as express-rate-limit, or rely on caching. The risk is low with in-memory data on one instance.

• info platform HTTP redirects to HTTPS

  Evidence: curl -sI http://adb-ankp0-dataviz-4fbum.ondigitalocean.app/ -> 301 Location: https://.../

  Fix: None needed.

Cloud resources and cost

Resources the agent created

The agent estimated $5.00 a month.

Code

Code

501 lines in 16 files (JavaScript 319, HTML 60, Shell 59, CSS 55, JSON 28, Markdown 27, YAML 16, Docker 8)

Dependencies

2 npm, 0 Python

Deploy config

Dockerfile .dockerignore .do/app.yaml

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts