Data / Visualization App on Railway

Screenshots

Technologies

Runtime

Node.js 20+

Frameworks

Node.js http module (built in)

Packaging

railway.json

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup
• Add a payment method to the account · 2 min
  resources: paid resources: adb-unbc1-dataviz

Stack fit

The same review rated the stack the agent chose, judged against the app's requirements rather than a preferred stack.

A zero-dependency Node.js server with in-memory CSV data and inline SVG charts is a well-reasoned, minimal stack for a small read-only dashboard, and it fits Railway's container model well. The build matched STACK.md.

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

A small zero-dependency Node.js dashboard on one Railway service. Secrets were handled cleanly, the site is HTTPS-only with a valid certificate, and nothing beyond the app is exposed. The main weaknesses are an app bug where a request for `//` crashes the process (an unauthenticated DoS made worse by a 5-retry restart cap), a deploy from an unversioned local upload with unpinned base image and Node version, missing security headers, a container that probably runs as root, and a plan that wasn't checked for commercial use.

Findings

• high app Unhandled URL parse error crashes the server (unauthenticated DoS)

  Evidence: app/server.js:25 `const url = new URL(req.url, 'http://localhost');` runs with no try/catch. Running the app locally, `curl --path-as-is http://localhost:3999//` returned 000, the process exited with 'TypeError: Invalid URL ... input: "//"', and a follow-up /health got no response. app/railway.json sets restartPolicyType ON_FAILURE with restartPolicyMaxRetries 5. Not sent to production, to avoid taking the live service down.

  Fix: Wrap URL parsing in try/catch and return 400, or parse req.url with a safe fallback. Add a process-level error boundary, and use restartPolicyType ALWAYS or a higher retry cap.

• medium deployment Deployed from an unversioned local upload with unpinned build inputs

  Evidence: process/deploy.md: `railway up --service adb-unbc1-dataviz-web --ci` with no GitHub repo connected. app/railway.json uses builder RAILPACK with its default base image. app/package.json has `"engines": { "node": ">=20" }`. app/deploy.sh runs `npm i -g @railway/cli` with no version.

  Fix: Deploy from a git repo the owner controls (Railway's GitHub integration) so every deploy maps to a commit. Pin the Node major version (e.g. .node-version or engines "22.x"), consider a Dockerfile with a digest-pinned base image, and pin the CLI version.

• medium deployment Plan not verified for commercial use

  Evidence: process/context.json shows use "commercial" and an empty account object. process/deployment.json gives the plan as "account's existing plan (usage-based)", and the notes assume 'covered by the Hobby plan's included usage'.

  Fix: Confirm the workspace is on a paid plan suited to business use (Railway Pro for commercial or team apps), not Trial or a personal Hobby workspace.

• low app No security headers

  Evidence: `curl -sI https://adb-unbc1-dataviz-web-production.up.railway.app/` returned only cache-control, content-type, date, server and x-railway-* headers: no Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options/frame-ancestors or Content-Security-Policy. app/server.js:20 writeHead sets only Content-Type and Cache-Control.

  Fix: Add HSTS, `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY` (or CSP frame-ancestors 'none') and a CSP in send(); the page is self-contained, so a strict CSP is feasible.

• low deployment Container likely runs as root

  Evidence: app/railway.json builds with Railpack's default image (the build log in process/deploy.md shows apt packages being installed), and no non-root user is configured anywhere.

  Fix: Use a Dockerfile based on node:<pinned>-slim with `USER node`, or a Railpack option that runs as non-root.

• low app No rate limiting on public API endpoints

  Evidence: app/server.js:24-48: /api/summary and /api/orders filter and sort all 2,400 rows on every request, with no throttling.

  Fix: The cost is small, but consider simple per-IP rate limiting or caching responses by filter key.

• info platform Malformed percent-encoding returns a Railway edge 502

  Evidence: GET /% and GET /%zz returned 502 'upstream error'. GET /%25 returned the app's 404.

  Fix: Platform behaviour; no action needed.

• info app Health endpoint shows the row count

  Evidence: GET /health returned 200 {"status":"ok","rows":2400}

  Fix: Harmless here; return only a status if you want minimal disclosure.

Cloud resources and cost

Resources the agent created

The agent estimated $1.00 a month.

Code

Code

371 lines in 12 files (JavaScript 183, HTML 176, JSON 33, Markdown 18, Shell 12)

Dependencies

0 npm, 0 Python

Deploy config

railway.json

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts