commit 7233aca · ran as web · 71s · ~18k tokens · evidence sealed & signed (manifest.json)
19/30▲ was 17/30
The submission runs successfully and its live behavior matches the README's boilerplate claims, with tests passing and no error leakage on hostile probes. However, based on the file tree, manifests, and source shown, this is essentially the stock Heroku Node.js getting-started template with no visible original feature work, so it's not possible to assess genuine coding ability beyond copying and running a reference project. Code quality must be scored conservatively given the thinness and boilerplate nature of what was actually shown.
Strengths
- App starts cleanly and the bundled jest suite (2 tests, IPv4/IPv6 bind checks) passes
- Live page content matches the README's described tutorial content, and 404/malformed-JSON hostile checks returned proper 404s with no stack trace leakage
- Sensible production touches carried from the template: keepAliveTimeout set above Heroku's router idle timeout, graceful SIGTERM handling
Concerns
- The entire repository, including index.js, package.json, README, and test.js, appears to be the unmodified heroku/node-js-getting-started template — there is no visible custom feature, route, or business logic that would demonstrate the candidate's own engineering beyond copying the reference project
- package.json declares engines node 22.x||24.x||26.x but the app was only verified running on node 18.20.4, producing EBADENGINE warnings; this mismatch was not resolved or explained
- Only one source file (index.js) was shown; there is no evidence of error handling, input validation, or any logic beyond a single static-plus-templated-view GET route, making it hard to assess real coding ability
- Test suite is the stock template's own smoke test, not something demonstrating candidate-authored test design or coverage of custom functionality
The submission's own tests
CI=true npx jest → PASS ✅
Security sweep
audit: no known vulnerabilities · secrets: no matches
Failure-mode probe
| Check | Status | Trace leaked |
|---|
| GET a route that does not exist | 404 | no |
| POST malformed JSON to / | 404 | no |
Ask the candidate
- This repo appears identical to the official heroku/node-js-getting-started template — what, if anything, did you build or modify yourself, and can you walk through a change you made and why?
- Your package.json requires node 22-26.x but the app was tested and ran on node 18.20.4 with EBADENGINE warnings — how would you actually enforce or reconcile the runtime version in a real deployment pipeline?
- The keepAliveTimeout is explicitly set to 95s with a comment about Heroku's router timeout — can you explain the race condition this prevents and what would happen if you removed that line?
What the cloud browser saw (189ms to DOM)
Mobile viewport
Generated by Gauntlet — sandboxes & cloud browsers by Solari, judgment by Claude. Verify this evidence: npm run verify -- <this directory>