Real-Time Collaborative App on Render

Screenshots

Technologies

Runtime

Node.js 20+

Frameworks

Node.js http module (built in)

Data

PostgreSQL (Render Postgres, free)

Libraries

wsnode-postgres

Packaging

Render Blueprint (render.yaml)

Hosting

Render web service (free, built from render-examples/express-hello-world)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The chat app itself is well built: input is validated, SQL is parameterized, the UI renders safely, nothing sensitive is exposed, and HTTPS is enforced. No secrets leaked. The biggest weakness is provenance: Render builds from a third-party example repo, and the real code arrives as an opaque tarball in a secret file. The free Postgres, which is likely reachable from the internet, expires on 2026-11-12, after which the app will fail to start. Security headers and rate limiting are also missing.

Findings

• high deployment Production built from a third-party example repo with code injected through a secret file

  Evidence: process/deploy.md service creation: "repo":"https://github.com/render-examples/express-hello-world","branch":"main" with buildCommand 'base64 -d /etc/secrets/app.b64 > /tmp/app.tgz; find . -mindepth 1 -maxdepth 1 ! -name app.b64 -exec rm -rf {} +; tar xzf /tmp/app.tgz; npm ci --omit=dev'; process/resources.json source = render-examples/express-hello-world

  Fix: Push the app to an owner-controlled Git repo, or deploy a digest-pinned image from an owner-controlled registry, and have Render build from that pinned commit. Don't route code through secret files under someone else's repo.

• medium deployment Free Postgres expires in 30 days and the app fails to start without it

  Evidence: process/resources.json expires_at 2026-11-12T23:32:51Z; app/store.js lines 13-32: init() runs CREATE TABLE against DATABASE_URL and server.js main() exits on error

  Fix: Use a paid Postgres plan (Basic) or a persistent alternative. At minimum, fall back to memory or degrade gracefully when the database is gone.

• medium deployment Postgres likely reachable from the internet

  Evidence: process/deploy.md: POST /v1/postgres body has no ipAllowList. Render's default allows external connections from 0.0.0.0/0. The app uses only internalConnectionString.

  Fix: Set the database ipAllowList to an empty list (internal-only), or restrict it to the specific admin IPs needed.

• low platform Free web service spins down when idle

  Evidence: process/deployment.json notes: 'sleeps after about 15 minutes idle ... open WebSockets are dropped'

  Fix: Use the Starter plan if the club needs the chat to be always available.

• low app No security headers

  Evidence: GET https://adb-p9gs9-realtime-web.onrender.com/?room=general returns only content-type, cache-control, and the platform's rndr-id/server/cf headers. There is no strict-transport-security, x-content-type-options, x-frame-options/frame-ancestors, or content-security-policy (server.js lines 80-84, 113).

  Fix: Add HSTS, X-Content-Type-Options: nosniff, a CSP with frame-ancestors 'none', and Referrer-Policy in sendJson and the index response.

• low deployment Runtime version only loosely pinned

  Evidence: process/deploy.md envVars NODE_VERSION="22"; app/package.json engines node >=20

  Fix: Pin an exact Node version (for example 22.x.y) through NODE_VERSION or .node-version.

• low app No rate limiting or connection caps on public endpoints

  Evidence: app/server.js lines 136-149 (POST messages), 151-172 (SSE) and 191-200 (WS upgrade) have no per-client limits. app/store.js line 18: the cache Map gets one entry for every room name requested and never evicts.

  Fix: Add per-IP rate limits on posting and connections, cap concurrent SSE/WS connections, and bound or LRU-evict the room cache.

• low app WebSocket upgrade doesn't check the Origin header

  Evidence: app/server.js lines 191-200: handleUpgrade is called without looking at req.headers.origin

  Fix: Accept upgrades only from the app's own origin.

• info deployment DB connection string copied as a literal env var; TLS verification disabled

  Evidence: process/deploy.md: envVars DATABASE_URL value = ci["internalConnectionString"]; app/store.js line 19: ssl { rejectUnauthorized: false }

  Fix: Use fromDatabase or an env group link so credentials rotate with the database, and verify TLS when connecting externally.

• info app No sensitive files or debug endpoints exposed

  Evidence: GET /.env, /.git/config, /package.json, /server.js, /app.b64 and /etc/secrets/app.b64 each return 404 {"error":"not found"}. A malformed path returns a generic Cloudflare 400.

  Fix: None needed.

Cloud resources and cost

Resources the agent created

The agent estimated $0.00 a month.

Code

Code

569 lines in 9 files (JavaScript 427, HTML 142, JSON 29, Markdown 20, YAML 18)

Dependencies

2 npm, 0 Python

Deploy config

render.yaml

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts