Infrastructure map

10 of 10 approved files read · test · Production unverified

3Infra checks to verify 2Missing 1Observed

Detected stack

JavaScriptJavaScript package manifestNeon AuthNeon PostgresNetlifyNetlify BlobsNode.js 24ReactStripe

Trace a customer journey

12 of 12 route checks await staging evidence. 0 passed on loopback.

→ Static request, route or import┄ Control review point

Sign in

POST /api/sign-in

Client
Submit the request
Reviewed source
Client → Ingress
Route request to function
Reviewed source
Edge rate limit · Missing in snapshot
Ingress → Application
Handle the request
Reviewed source
Application rate limit · Found in source
Application → Services
Neon Auth
Reviewed source
Sign-in establishes a session · Needs evidence

Sign-in establishes a sessionNeeds evidence · Awaiting verification

Step 4 · Neon Auth

Route-specific source evidence is needed for this control.

Next action Sign in with a designated test identity. Read its session and confirm the account matches.

No matching source or provider evidence

null-security map verify --workspace DIR --origin APPROVED_ORIGIN --route /api/sign-in --check signin_session

Application rate limitFound in source · Awaiting verification

Step 3 · Handle the request

The sign-in function calls its local limiter.

Next action Inspect the limiter on this branch and check when it returns HTTP 429.

netlify/functions/session.js:1 · netlify/functions/limiter.js:1

null-security map verify --workspace DIR --origin APPROVED_ORIGIN --route /api/sign-in --check rate

Edge rate limitMissing in snapshot · Awaiting verification

Step 2 · Route request to function

This zone snapshot has no enabled rate limiting rule that mitigates traffic. Other zones, application limits and other providers are separate.

Next action Review the zone snapshot for this exact host and route. Test normal and above-threshold traffic in staging.

cloudflare-ratelimit.json

Inspect Cloudflare draft

null-security cloudflare rule draft --workspace DIR --host staging.example.invalid --route /api/sign-in --file rule.json
null-security cloudflare rule review --workspace DIR --host staging.example.invalid --route /api/sign-in --file rule.json --actor NAME

null-security map verify --workspace DIR --origin APPROVED_ORIGIN --route /api/sign-in --check edge

Buy a subscription

POST /api/checkout

Client
Submit the request
Reviewed source
Client → Ingress
Route request to function
Reviewed source
Edge rate limit · Missing in snapshot
Ingress → Application
Handle the request
Reviewed source
Application → Services
Stripe
Reviewed source
Session required · Needs evidence
Application rate limit · Needs evidence

Session requiredNeeds evidence · Awaiting verification

Step 4 · Stripe

Route-specific source evidence is needed for this control.

Next action Send an anonymous request and confirm the handler rejects it before performing work.

No matching source or provider evidence

null-security map verify --workspace DIR --origin APPROVED_ORIGIN --route /api/checkout --check session

Application rate limitNeeds evidence · Awaiting verification

Step 4 · Stripe

Route-specific source evidence is needed for this control.

Next action Inspect the limiter on this branch and check when it returns HTTP 429.

No matching source or provider evidence

null-security map verify --workspace DIR --origin APPROVED_ORIGIN --route /api/checkout --check rate

Edge rate limitMissing in snapshot · Awaiting verification

Step 2 · Route request to function

This zone snapshot has no enabled rate limiting rule that mitigates traffic. Other zones, application limits and other providers are separate.

Next action Review the zone snapshot for this exact host and route. Test normal and above-threshold traffic in staging.

cloudflare-ratelimit.json

Inspect Cloudflare draft

null-security cloudflare rule draft --workspace DIR --host staging.example.invalid --route /api/checkout --file rule.json
null-security cloudflare rule review --workspace DIR --host staging.example.invalid --route /api/checkout --file rule.json --actor NAME

null-security map verify --workspace DIR --origin APPROVED_ORIGIN --route /api/checkout --check edge

Download the release

POST /api/download

Client
Submit the request
Reviewed source
Client → Ingress
Route request to function
Reviewed source
Edge rate limit · Missing in snapshot
Ingress → Application
Handle the request
Reviewed source
Application → Services
Netlify Blobs
Reviewed source
Session required · Needs evidence
Paid access required · Needs evidence
Application rate limit · Needs evidence

Session requiredNeeds evidence · Awaiting verification

Step 4 · Netlify Blobs

Route-specific source evidence is needed for this control.

Next action Send an anonymous request and confirm the handler rejects it before performing work.

No matching source or provider evidence

null-security map verify --workspace DIR --origin APPROVED_ORIGIN --route /api/download --check session

Paid access requiredNeeds evidence · Awaiting verification

Step 4 · Netlify Blobs

Route-specific source evidence is needed for this control.

Next action Try an unpaid test session and confirm delivery is denied before reading the release.

No matching source or provider evidence

null-security map verify --workspace DIR --origin APPROVED_ORIGIN --route /api/download --check entitlement

Application rate limitNeeds evidence · Awaiting verification

Step 4 · Netlify Blobs

Route-specific source evidence is needed for this control.

Next action Inspect the limiter on this branch and check when it returns HTTP 429.

No matching source or provider evidence

null-security map verify --workspace DIR --origin APPROVED_ORIGIN --route /api/download --check rate

Edge rate limitMissing in snapshot · Awaiting verification

Step 2 · Route request to function

This zone snapshot has no enabled rate limiting rule that mitigates traffic. Other zones, application limits and other providers are separate.

Next action Review the zone snapshot for this exact host and route. Test normal and above-threshold traffic in staging.

cloudflare-ratelimit.json

Inspect Cloudflare draft

null-security cloudflare rule draft --workspace DIR --host staging.example.invalid --route /api/download --file rule.json
null-security cloudflare rule review --workspace DIR --host staging.example.invalid --route /api/download --file rule.json --actor NAME

null-security map verify --workspace DIR --origin APPROVED_ORIGIN --route /api/download --check edge

Receive a Stripe webhook

POST /api/webhook

Services
Deliver a billing event
Reviewed source
Services → Ingress
Route request to function
Reviewed source
Ingress → Application
Handle the request
Reviewed source
Webhook signature required · Found in source
Application → Services
Stripe
Reviewed source
Webhook retry handled once · Needs evidence

Webhook signature requiredFound in source · Awaiting verification

Step 3 · Handle the request

The sample webhook calls Stripe signature verification.

Next action Send an invalid signature and confirm the webhook rejects it.

netlify/functions/webhook.js:1

null-security map verify --workspace DIR --origin APPROVED_ORIGIN --route /api/webhook --check signature

Webhook retry handled onceNeeds evidence · Awaiting verification

Step 4 · Stripe

Route-specific source evidence is needed for this control.

Next action Deliver one signed sandbox event twice. Confirm processing on the first delivery and deduplication on the retry.

No matching source or provider evidence

null-security map verify --workspace DIR --origin APPROVED_ORIGIN --route /api/webhook --check retry

Changes since the previous snapshot

The first export establishes the comparison point.

What needs attention

Show

MissingRate limiting missing in Cloudflare snapshotEdge rate limiting

This zone snapshot has no enabled rate limiting rule that mitigates traffic. Other zones, application limits and other providers are separate.

Next action: Draft a Cloudflare rule for the affected host and route. Set a threshold using normal traffic, then test it before enabling it.

Verify: Verify proxied DNS, direct-origin access and rule order. In staging, check normal traffic and the blocked response above the threshold.

Evidence: cloudflare-ratelimit.json

Trace component · Cloudflare setup

MissingGlobal header declarations missingNetlify

content-security-policy, x-content-type-options not declared on the supported global rule in this file. A different layer may supply them.

Next action: Set the missing headers on the hosting configuration or document the layer that supplies them.

Verify: Inspect a deployed response for each header.

Evidence: netlify.toml

Trace component

Needs evidenceApplication rate limiting unverifiedcheckout

No supported limiter pattern was identified in the handler’s approved import graph. Shared middleware or an upstream proxy may enforce one.

Next action: Inspect shared middleware and ingress policy before adding another limiter.

Verify: Exercise the route with a bounded burst in staging and record the response.

Evidence: netlify/functions/checkout.js

Trace component

Needs evidenceApplication rate limiting unverifieddownload

No supported limiter pattern was identified in the handler’s approved import graph. Shared middleware or an upstream proxy may enforce one.

Next action: Inspect shared middleware and ingress policy before adding another limiter.

Verify: Exercise the route with a bounded burst in staging and record the response.

Evidence: netlify/functions/download.js

Trace component

Needs evidenceApplication rate limiting unverifiedwebhook

No supported limiter pattern was identified in the handler’s approved import graph. Shared middleware or an upstream proxy may enforce one.

Next action: Inspect shared middleware and ingress policy before adding another limiter.

Verify: Exercise the route with a bounded burst in staging and record the response.

Evidence: netlify/functions/webhook.js

Trace component

In configuration / sourceApplication limiter pattern foundsession

A reachable module calls a limiter and rejects with HTTP 429. Individual routes may bypass this branch.

Next action: Review where the limiter runs and which client identity it counts.

Verify: In staging, exceed the limit on the intended route and check that ordinary requests still succeed.

Evidence: netlify/functions/limiter.js

Trace component

Cloudflare setup

Import a zone rate limiting snapshot to check its configuration. For a new rule, select one route below. Replace the example host, tune the threshold to normal traffic, and check plan support and webhook exclusions. The proposal is disabled.

Rule target

{
  "description": "Null Security | reviewed route limit",
  "enabled": false,
  "action": "block",
  "action_parameters": {
    "response": {
      "status_code": 429,
      "content": "null_edge_rate_limit",
      "content_type": "text/plain"
    }
  },
  "expression": "(http.host eq \"staging.example.invalid\" and http.request.uri.path eq \"/api/checkout\")",
  "ratelimit": {
    "characteristics": [
      "cf.colo.id",
      "ip.src"
    ],
    "period": 10,
    "requests_per_period": 30,
    "mitigation_timeout": 10
  }
}

{
  "description": "Null Security | reviewed route limit",
  "enabled": false,
  "action": "block",
  "action_parameters": {
    "response": {
      "status_code": 429,
      "content": "null_edge_rate_limit",
      "content_type": "text/plain"
    }
  },
  "expression": "(http.host eq \"staging.example.invalid\" and http.request.uri.path eq \"/api/download\")",
  "ratelimit": {
    "characteristics": [
      "cf.colo.id",
      "ip.src"
    ],
    "period": 10,
    "requests_per_period": 30,
    "mitigation_timeout": 10
  }
}

{
  "description": "Null Security | reviewed route limit",
  "enabled": false,
  "action": "block",
  "action_parameters": {
    "response": {
      "status_code": 429,
      "content": "null_edge_rate_limit",
      "content_type": "text/plain"
    }
  },
  "expression": "(http.host eq \"staging.example.invalid\" and http.request.uri.path eq \"/api/sign-in\")",
  "ratelimit": {
    "characteristics": [
      "cf.colo.id",
      "ip.src"
    ],
    "period": 10,
    "requests_per_period": 30,
    "mitigation_timeout": 10
  }
}

{
  "description": "Null Security | reviewed route limit",
  "enabled": false,
  "action": "block",
  "action_parameters": {
    "response": {
      "status_code": 429,
      "content": "null_edge_rate_limit",
      "content_type": "text/plain"
    }
  },
  "expression": "(http.host eq \"staging.example.invalid\" and http.request.uri.path eq \"/api/webhook\")",
  "ratelimit": {
    "characteristics": [
      "cf.colo.id",
      "ip.src"
    ],
    "period": 10,
    "requests_per_period": 30,
    "mitigation_timeout": 10
  }
}

Cloudflare’s rule creation guide ↗

Evidence index

Technology evidence

JavaScript · netlify/functions/checkout.js · netlify/functions/download.js · netlify/functions/limiter.js · netlify/functions/session.js · netlify/functions/webhook.js · src/portal.jsx

JavaScript package manifest · package.json

Neon Auth · netlify/functions/session.js · package.json

Neon Postgres · netlify/functions/checkout.js · netlify/functions/download.js · package.json

Netlify · netlify.toml

Netlify Blobs · netlify/functions/download.js · package.json

Node.js 24 · package.json

React · package.json

Stripe · netlify/functions/checkout.js · netlify/functions/webhook.js · package.json

Connection evidence (14)

Netlify → checkout · routes to
netlify.toml · netlify/functions/checkout.js

checkout → Neon Postgres · imports SDK
netlify/functions/checkout.js

checkout → Stripe · imports SDK
netlify/functions/checkout.js

Netlify → download · routes to
netlify.toml · netlify/functions/download.js

download → Neon Postgres · imports SDK
netlify/functions/download.js

download → Netlify Blobs · imports SDK
netlify/functions/download.js

Netlify → session · routes to
netlify.toml · netlify/functions/session.js

session → Neon Auth · imports SDK
netlify/functions/session.js

Netlify → webhook · routes to
netlify.toml · netlify/functions/webhook.js

webhook → Stripe · imports SDK
netlify/functions/webhook.js

Request client → checkout · fetches route
src/portal.jsx · netlify/functions/checkout.js

Request client → download · fetches route
src/portal.jsx · netlify/functions/download.js

Request client → session · fetches route
src/portal.jsx · netlify/functions/session.js

Edge rate limiting → Netlify · review boundary
cloudflare-ratelimit.json

Scope and limits

Only explicitly approved files are examined. Declarations, SDK imports and rule snapshots do not prove deployment or enforcement. Dynamic routes, unscoped modules and unsupported stacks may be absent. This map is advisory; it does not change the assessment gate.

Collection details

Captured Illustrative fixture · Snapshot 58f947bdc2a6fed1

Inputs with unreadable, unresolved or unsupported details: None flagged by the supported adapters.

Infrastructure map

Trace a customer journey

System schematic

Sign in

Buy a subscription

Download the release

Receive a Stripe webhook

Changes since the previous snapshot

What needs attention

Cloudflare setup

Evidence index

Scope and limits