API / Backend Service on Render

Screenshots

Technologies

Runtime

Node.js 22

Frameworks

Express

Data

PostgreSQL (Render Postgres, free)

Libraries

node-postgres

Packaging

Render Blueprint (render.yaml)

Hosting

Render web service (free, running the prebuilt image node:22-alpine)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The Notes API on Render keeps secrets in platform env vars, enforces per-key ownership with parameterized queries, serves only HTTPS and exposes nothing beyond its documented endpoints. Its main weakness is deployment provenance: the app source is stuffed into an env var and eval'd at boot on an unpinned node:22-alpine image, with npm ci running at runtime. Other problems: the free Postgres expires on 2026-11-12, which breaks the durable-storage requirement; the database's external endpoint is left open; the container runs as root; and no security headers are set.

Findings

• medium deployment App source shipped in env var and eval'd at start; no build artifact

  Evidence: process/deploy.md: service created with envVars APP_TGZ_B64=<base64 tarball> and BOOTJS, dockerCommand 'node -e eval(process.env.BOOTJS)', which untars to /app and runs npm ci at boot; app/scripts/render-push.sh lines 7-10

  Fix: Connect a Git repo (render.yaml already exists) or build and push an image to a registry the owner controls, so each deploy is tied to a commit or digest. Install dependencies at build time, not at container start.

• medium deployment Unpinned base image and dependencies fetched from the registry at runtime

  Evidence: process/resources.json source 'docker.io/library/node:22-alpine' (tag, no @sha256 digest); BOOTJS runs 'npm ci --omit=dev' on every instance start

  Fix: Pin the base image by digest and bake node_modules into the image at build time.

• medium deployment Free Postgres expires after 30 days, losing notes

  Evidence: process/resources.json postgres expires_at '2026-11-12T23:15:14Z'; TASK.md 'Store notes in a database that survives restarts and redeploys'; deployment.json notes acknowledge the expiry

  Fix: Use a paid Render Postgres plan such as basic-256mb (~$6/mo), as render.yaml already specifies, or another durable database.

• medium deployment Database external endpoint left open to the internet

  Evidence: process/deploy.md POST /v1/postgres body has no ipAllowList, so Render's default allows external connections from 0.0.0.0/0; the agent fetched externalConnectionString into .env

  Fix: Set an empty or narrow ipAllowList on the database so only the private network can reach it.

• low deployment Container runs as root

  Evidence: Official node:22-alpine defaults to root; dockerCommand 'node -e eval(process.env.BOOTJS)' writes to /app and /tmp and does not drop to the 'node' user

  Fix: Use a Dockerfile with USER node, or start under a non-root user.

• low app TLS certificate verification disabled for DB SSL

  Evidence: app/src/db.js:11 ssl: { rejectUnauthorized: false }

  Fix: Verify the server certificate (rejectUnauthorized: true with the provider CA) when connecting over the external URL.

• low app No security headers

  Evidence: curl -D - https://adb-kpiad-api-web.onrender.com/docs returned no strict-transport-security, x-content-type-options, x-frame-options or content-security-policy headers

  Fix: Add helmet or set HSTS, nosniff, frame-ancestors and a CSP in Express.

• low app Unauthenticated and invalid-key requests are not rate limited

  Evidence: app/src/app.js:51-59 auth check runs before rateLimitMiddleware, which is keyed only by valid key; GET /v1/notes with X-API-Key: bogus -> 401 with no limit headers

  Fix: Add a per-IP limiter on failed auth attempts.

• info app No per-field size limits

  Evidence: app/src/app.js validateNote checks types only; express.json limit '1mb' is the only bound

  Fix: Cap title, content and tag lengths and the number of tags.

• info app No sensitive files or debug endpoints exposed

  Evidence: GET /.env, /.git/config, /package.json, /src/server.js, /admin, /debug -> 404 {"error":"Not found: ..."}

  Fix: None needed.

Cloud resources and cost

Resources the agent created

The agent estimated $0.00 a month.

Code

Code

458 lines in 12 files (JavaScript 447, JSON 31, YAML 24, Markdown 22, Shell 11)

Dependencies

2 npm, 0 Python

Deploy config

render.yaml

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts