Static Content Site on Render

Screenshots

Technologies

Runtime

Node.js 22

Frameworks

Node.js http module (built in)

Packaging

Render Blueprint (render.yaml)

Hosting

Render web service (free, running the prebuilt image node:22-alpine)

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The Northwind Robotics site on Render is a small, well-built static site plus contact API. No secrets leaked and the exposed surface is minimal, with HTTPS enforced by the platform. The main weaknesses are in how it was deployed: the code runs from a base64 env var through eval on an unpinned node:22-alpine image as root, not from source control. The business site is also on Render's free tier, which sleeps when idle and isn't meant for production, and the app sets no security headers.

Findings

• medium deployment Commercial site on Render free instance that sleeps

  Evidence: process/context.json use=commercial; process/resources.json plan=free; deployment.json notes: 'Free plan: the service spins down after about 15 minutes idle ... 30-60s (cold start)'

  Fix: Move the service to a paid instance type (e.g. Starter) so it stays up and is supported for production use, or host the static pages on a Render Static Site.

• medium deployment App code shipped as an eval'd base64 env var instead of from source control

  Evidence: deploy.md: PATCH dockerCommand 'node -e eval(atob(process.env.BOOT))' with BOOT holding a JS bundle of server.js/public/* that is written to /tmp/app and loaded

  Fix: Deploy from a Git repo the owner controls (render.yaml is already present) or from a versioned image built in CI and pushed to an owned registry, so every deploy is tied to a reviewed commit.

• low deployment Base image not pinned to a digest

  Evidence: deploy.md service creation: imagePath 'docker.io/library/node:22-alpine', autoDeploy 'yes'

  Fix: Pin the image by digest (node:22-alpine@sha256:...) and update it on purpose.

• low deployment Container runs as root

  Evidence: Stock node:22-alpine image runs as root by default; the dockerCommand in deploy.md sets no user and writes to /tmp/app

  Fix: Use a Dockerfile with USER node (or an equivalent non-root user).

• low app No security headers

  Evidence: curl -I https://adb-2ksu4-static-web.onrender.com/ returns only content-type, cache-control, server: cloudflare and Render headers; no Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options or X-Frame-Options. app/server.js:50-54 sets only Content-Type/Length/Cache-Control

  Fix: Add HSTS, a strict CSP (default-src 'self'), X-Content-Type-Options: nosniff and frame-ancestors 'none' / X-Frame-Options: DENY in sendFile and sendJson.

• low app Contact endpoint has no rate limiting or anti-spam control

  Evidence: app/server.js:59-87 accepts unlimited POST /api/contact requests; there is no throttling, honeypot or CAPTCHA

  Fix: Add per-IP rate limiting and a honeypot field, or Render/Cloudflare rate-limit rules.

• info app Submitter email addresses written to logs

  Evidence: app/server.js:84 console.log(`Contact submission from ${body.email.trim()}`)

  Fix: Leave personal data out of logs, or redact it, since submissions aren't meant to be stored.

• info app Health endpoint publicly reachable

  Evidence: GET /healthz -> 200 {"ok":true}; app/server.js:98

  Fix: Acceptable as is; it reveals nothing. Optionally restrict it to the health checker.

• info platform HTTPS and redirect handled correctly by platform

  Evidence: curl -I http://adb-2ksu4-static-web.onrender.com/ -> 301 Location https://...; cert CN=onrender.com, issuer Google Trust Services WE1, valid until Dec 20 2026

  Fix: None.

Cloud resources and cost

Resources the agent created

The agent estimated $0.00 a month.

Code

Code

459 lines in 13 files (JavaScript 219, HTML 185, CSS 55, JSON 26, Markdown 8, YAML 8)

Dependencies

0 npm, 0 Python

Deploy config

render.yaml

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts