Real-Time Collaborative App on Vercel

Screenshots

Technologies

Runtime

Node.js

Frameworks

Next.jsReact

Libraries

Upstash Redis SDKnode-redisVercel Functions helpers

Dev tools

TypeScript

Packaging

vercel.json

Hosting

Vercel project (Next.js)Vercel Functions

Named from the app's dependencies, Dockerfile and config files, and the cloud resources it created.

Checks

Black-box checks against the live URL. A cell succeeds when every required check passes. The app's spec

Human steps

• Sign up for an account and verify the email address · 3 min
  prerequisite: account setup
• Create an API token and hand it to the agent · 2 min
  prerequisite: account setup

Security & compliance review

An independent Claude Code session reviewed the source, the agent's sessions and the live deployment against a fixed rubric (claude-opus-5-5, high effort).

The Vercel Hobby deployment of this personal club chat app is clean. No secrets are involved or leaked, HTTPS is enforced with HSTS, no source or config files are exposed, and input validation and output escaping are sound. The main weakness is that the public POST and long-lived SSE endpoints have no rate limiting or connection caps. Minor issues: deployment protection is turned off for previews too, the CLI and dependency ranges are unpinned, and the app sets no security headers.

Findings

• medium app No rate limiting or connection caps on public message and SSE endpoints

  Evidence: app/app/api/rooms/[room]/[action]/route.ts: postMessage has no throttling; events() loops for STREAM_MS=270000 polling store.latest every POLL_MS=500 with maxDuration=300; unlimited rooms can be created. A POST to /api/rooms/sec-review-19779/messages succeeded anonymously with 201.

  Fix: Add per-IP rate limiting (for example the Vercel Firewall rate-limit rules or a KV-backed limiter), cap concurrent SSE streams per IP, and cap the number of rooms or messages per period.

• low deployment Deployment protection disabled for all deployments, including previews

  Evidence: process/deploy.md:278: PATCH /v9/projects/adb-raatw-realtime-web with {"ssoProtection":null}

  Fix: Use Standard Protection, which keeps the production domain public but protects preview and per-deployment URLs, rather than turning protection off entirely.

• low deployment Unpinned deploy tooling and dependency ranges, no source repo of record

  Evidence: process/deploy.md:20,222: `npx -y vercel@latest`; process/build.md:21: `npm i next@latest react@latest ...`; app/package.json uses ^ ranges. Deployed by `vercel deploy --prod` from a local directory with a local-only git repo. The lockfile was uploaded (deploy.md:707).

  Fix: Pin the Vercel CLI version, keep the committed lockfile with exact versions, and deploy from an owner-controlled git repository connected to the Vercel project.

• low app Missing CSP, X-Content-Type-Options and frame protection headers

  Evidence: curl -sI https://adb-raatw-realtime-web.vercel.app/ returns only strict-transport-security (platform), with no content-security-policy, x-content-type-options or x-frame-options

  Fix: Add a headers() block in next.config, or a headers entry in vercel.json, setting CSP with frame-ancestors 'none', X-Content-Type-Options: nosniff and Referrer-Policy.

• low deployment Vercel token passed on the command line

  Evidence: process/deploy.md:20 and later: VC="npx -y vercel@latest --token $VERCEL_TOKEN ..." (the transcript shows only the variable name, so nothing leaked)

  Fix: Let the CLI read VERCEL_TOKEN from the environment instead of passing --token, so the token never shows up in process arguments.

• info app Framework disclosed via x-powered-by header

  Evidence: curl -sI https://adb-raatw-realtime-web.vercel.app/ returns `x-powered-by: Next.js`

  Fix: Set poweredByHeader: false in next.config.

• info deployment Message history kept in ephemeral, shared Runtime Cache

  Evidence: process/deployment.json notes: Upstash couldn't be provisioned; history is in Vercel Runtime Cache (LRU eviction possible, 7-day TTL, shared on Hobby); app/lib/store.ts RuntimeCacheStore

  Fix: Finish the documented human step to attach Upstash Redis (or another durable store) so room history survives eviction.

• info app User content is rendered safely

  Evidence: A POST with text "<img src=x onerror=alert(1)>" is stored verbatim and rendered as React text. GET /?room=<script>alert(1)</script> renders it escaped as &lt;script&gt;. The validation probes (bad JSON, null body, text 123, an empty string, 1001 characters, a 70-character room name) all returned 400.

  Fix: No action needed.

Cloud resources and cost

Resources the agent created

The agent estimated $0.00 a month.

Code

Code

540 lines in 15 files (TypeScript 431, JSON 94, JavaScript 92, Markdown 17, CSS 17)

Dependencies

9 npm, 0 Python

Deploy config

vercel.json

The agent's sessions

The agent's deploy summary

Raw data

Report on GitHub Full record (JSON) Workflow run, with transcripts