PriceGhost - Moses Yebei

The Problem

Price trackers like Keepa and CamelCamelCamel fail on non-standard retailers and often scrape the wrong value — a "Save $200" discount or a monthly payment instead of the actual price. PriceGhost solves this with a multi-strategy extraction system where the user arbitrates conflicting results.

What This Does

PriceGhost is a self-hosted full-stack app: a React/TypeScript frontend (frontend/), an Express/TypeScript backend (backend/), and a PostgreSQL schema (database/init.sql). It monitors product prices from any website, notifies via Telegram/Discord/Pushover, and tracks price history.

The core differentiator is the Price Voting Modal — four independent extraction methods (JSON-LD, site-specific scrapers, generic CSS, AI analysis) run in parallel and "vote" on the price. When they disagree, the user sees all candidates with confidence scores and picks the correct one.

How It Is Wired

Execution starts at backend/src/index.ts (startServer), which calls runMigrations (a database write via client.query) and then serves the API. The scraper pipeline lives in backend/src/services/scraper.ts — scrape calls parsePrice 14 times and addPrice 5 times, and scrapeProduct runs the extraction strategies. The AI fallback is in backend/src/services/ai-extractor.ts, which calls a model for inference and makes outbound network calls.

The frontend routes through frontend/src/api/client.ts — 12 modules import it, making it the highest-blast-radius hub. clearMessages is called from 22 places and prepareHtmlForAI from 16, so changes to those ripple widely. The call graph shows no circular dependencies, which keeps the module graph clean.

The notification path is checkPrices -> sendNotifications (3 edges), handled by backend/src/services/notifications.ts, which owns all outbound notification calls. The auth chain is backend/src/middleware/auth.ts (JWT generation, cryptographic ops), used by 7 modules.

How To Use It

The repo includes docker-compose.yml and Dockerfiles for both services, so the container path is the fastest:

git clone https://github.com/moses-y/PriceGhost
cd PriceGhost
cp backend/.env.example backend/.env  # configure DB, JWT secret, notification keys
docker-compose up --build

The frontend runs on Vite (dev) or nginx (prod, via frontend/nginx.conf). For local development, run npm install in both frontend/ and backend/, then start each with npm run dev. The backend requires a PostgreSQL instance and the env vars in backend/.env.example.

Real-World Use

A user tracks a GPU across Newegg and Best Buy. PriceGhost's site-specific scrapers handle both, but when Newegg returns a bundle price instead of the card alone, the AI arbitration flags the discrepancy, the modal shows both candidates, and the user picks the single-card price. Notifications fire when it drops below the target.

Code Health & Issues

Static analysis found 18 findings (5 high, 13 medium, 0 low). The high-severity items:

High — Deep nesting (depth 8) in backend/src/services/scraper.ts, frontend/src/components/Layout.tsx, frontend/src/pages/Settings.tsx; hard to follow control flow.
High — Oversized files: backend/src/models/index.ts at 895 lines, backend/src/services/scraper.ts, frontend/src/pages/Settings.tsx.
High — 63 duplicated 6-line blocks across 19 files; extract shared helpers.
Medium — Hub module frontend/src/api/client.ts (12 dependents); high churn blast radius.

SDLC gaps: no test suite (46 source files, zero tests), no LICENSE file (defaults to all-rights-reserved), wildcard CORS in backend/src/index.ts, and SQL string interpolation in backend/src/models/index.ts. CI uses mutable GitHub Action tags (@v3, @v5) instead of pinned SHAs, and the Docker base image node:20-slim is unpinned by digest.

The Bottom Line

The multi-strategy extraction with user arbitration is genuinely differentiated and the codebase is cleanly structured with no circular dependencies. The lack of tests and the SQL injection risk in the models layer are the two things to fix before production. For a technical user who wants control over what they track, this is a solid self-hosted option.

What the analyser found

Deployment readiness

5/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

75 files

TypeScript22
TSX22
JSON10
YAML2
Markdown2
JavaScript2

ReactDocker

Module dependencies

The 10 most depended-upon modules of 45, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_frontend_src_api_client["client"] n1_backend_src_models_index["index"] n2_backend_src_middleware_auth["auth"] n3_ontend_src_components_Layout["Layout"] n4_backend_src_services_scraper["scraper"] n5_frontend_src_hooks_useAuth["useAuth"] n6_backend_src_config_database["database"] n7_src_components_AIStatusBadge["AIStatusBadge"] n8_tend_src_components_AuthForm["AuthForm"] n9_tend_src_context_AuthContext["AuthContext"] n1_backend_src_models_index --> n6_backend_src_config_database n7_src_components_AIStatusBadge --> n0_frontend_src_api_client n8_tend_src_components_AuthForm --> n0_frontend_src_api_client n3_ontend_src_components_Layout --> n5_frontend_src_hooks_useAuth n9_tend_src_context_AuthContext --> n0_frontend_src_api_client n5_frontend_src_hooks_useAuth --> n9_tend_src_context_AuthContext

Findings

MediumNo test files detected - untested code paths repository-wide
MediumNo LICENSE file - unclear usage/redistribution rights root

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high5

medium3

low2

Pin third-party GitHub Actions to a commit SHAhigh5 occurrences

.github/workflows

dorny/paths-filter@v3, docker/setup-buildx-action@v3, docker/login-action@v3, docker/metadata-action@v5

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Add a LICENSE; redistribution rights are undefinedhigh

no licence file at the repository root

Fix: Add MIT or Apache-2.0 at the repository root.

Add a test suite; this repository has nonehigh46 occurrences

46 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Replace the wildcard CORS origin with an explicit allow listhigh

backend/src/index.ts

cors()

Any page on the internet can call the API with the browser's cookies attached, so a logged-in visitor to an unrelated site performs authenticated requests without knowing, and the wildcard combined with credentials is the exact configuration browsers refuse for that reason.

Fix: List the origins the API actually serves, and never pair a wildcard with credentials.

Use bound parameters instead of building the SQL stringhigh

backend/src/models/index.ts

.query() with an interpolated query

A value spliced into SQL is read as syntax, so one quote in a name ends the literal and everything after it is executed as the query, which is how a search box becomes a table drop.

Fix: Pass placeholders and hand the values to the driver as parameters.

Enable Dependabot or Renovatemedium

2 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium2 occurrences

backend/Dockerfile

node:20-slim, node:20-slim

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set timeout-minutes on the workflow jobslow

.github/workflows/docker-build.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.