Static Content Site on Cloudish

Screenshots

Technologies

Runtime

Node.js 22

Frameworks

Node.js http module (built in)

Packaging

Docker (node:22-alpine)

Hosting

Cloudish container (shared)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

None: the agent got everything it needed on its own.

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The Northwind Robotics site is a small, dependency-free Node server that runs as a non-root user. It handles secrets well: the Cloudish key never reached logs, the build context or the image. It serves only allowlisted paths over HTTPS with HSTS, and validates contact input soundly. The main problem is compliance: a commercial site is hosted on an agent-minted, unclaimed key whose free 0.1-credit grant runs out in about 9 hours of uptime, and no human account holder has accepted the provider's terms. Smaller issues are the unpinned base image, ownership by the agent's key, missing app-set security headers, and permissive CORS added by the platform.

Findings

• high deployment Commercial site runs on an unclaimed free-grant key that will run out within hours

  Evidence: process/context.json: use=commercial, balance_usd=0.097697. process/deployment.json human_steps: 'The free grant is only 0.1 credits (~$0.10), about 9 hours of active container time... Once it runs out the site returns 402/503', marked blocking:false. deploy.md line 100: key minted by unauthenticated POST /api/v1/keys with no human account holder.

  Fix: Have the business claim the key (or create an account it owns), accept the provider's terms for commercial use, and fund it with prepaid credits or auto top-up before launch. Treat this as a blocking step.

• medium deployment Deployment is owned by an agent-minted key, not by the business

  Evidence: deploy.md lines 100-160: the project is owned by apiKey id 69 'adb-ebio7-static' (email null, unclaimed). The build context was a local tarball (/tmp/context.tar.gz), not a repository the owner controls.

  Fix: Move the project under an owner-controlled account and deploy from an owner-controlled repository or a recorded commit.

• low deployment Base image not pinned by digest

  Evidence: app/Dockerfile line 1: FROM node:22-alpine

  Fix: Pin the base image by digest, e.g. node:22-alpine@sha256:<digest>, and update it on purpose.

• low platform Ingress reflects any Origin with credentials allowed

  Evidence: curl -H 'Origin: https://evil.example' https://adb-ebio7-static-web.on.do.cloudish.ai/ -> access-control-allow-origin: https://evil.example, access-control-allow-credentials: true. The OPTIONS preflight on /api/contact allows GET,HEAD,PUT,PATCH,POST,DELETE.

  Fix: The platform should not add permissive CORS by default, or should let apps turn it off. Impact is low here: there are no cookies or auth, and the contact endpoint is meant to be public.

• low app Missing security headers the app could set

  Evidence: GET / response headers contain only content-type, content-length, vary, CORS and strict-transport-security (HSTS comes from the platform). There is no X-Content-Type-Options, X-Frame-Options/frame-ancestors or Content-Security-Policy. The app/server.js send() and sendJson() functions set only Content-Type and Content-Length.

  Fix: Add X-Content-Type-Options: nosniff, a CSP such as default-src 'self'; frame-ancestors 'none', and Referrer-Policy in send() and sendJson().

• low app No rate limiting or field length limits on the contact endpoint

  Evidence: app/server.js lines 47-68: the only limit is the 64 KB total body size. POST /api/contact with a valid body returned {"ok":true} 200 with no throttling.

  Fix: Add per-IP rate limiting, per-field maximum lengths and an optional honeypot field.

• info app Submitter email addresses written to container logs

  Evidence: app/server.js line 65: console.log(`contact submission from ${body.email.trim()}`)

  Fix: Avoid logging personal data, or mask it, and document how long logs are kept.

• info app Extra /healthz endpoint

  Evidence: GET /healthz -> 200 {"ok":true}

  Fix: Harmless, but remove it if the platform doesn't need it.

Cloud resources and cost

Resources the agent created

The agent estimated $7.73 a month.

Code

Code

289 lines in 13 files (JavaScript 179, HTML 89, JSON 24, CSS 13, Docker 8, Markdown 5)

Dependencies

0 npm, 0 Python

Deploy config

Dockerfile .dockerignore

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts