Health check endpoint exists, returns HTTP 200, verifies critical dependencies, and consumed by load balancer
Why it matters
A health check endpoint that only returns HTTP 200 without verifying the database or downstream services will report healthy during a database connection pool exhaustion or broken third-party integration — exactly the conditions that cause user-facing failures. NIST SI-6 requires software verification; ISO 25010 reliability.availability requires accurate system state reporting. A load balancer routing traffic to a broken instance that reports itself healthy multiplies the failure, not the resilience. The health endpoint is the contract between your application and its infrastructure.
Severity rationale
Low because a shallow health check returns false positives under partial failures, causing load balancers to route to unhealthy instances rather than triggering failover — the gap is only realized during compound failures.
Remediation
Create an /api/health route that verifies your critical dependencies before returning 200.
// src/app/api/health/route.ts
import { NextResponse } from 'next/server';
import { createClient } from '@/lib/supabase/server';
export async function GET() {
try {
const supabase = createClient();
await supabase.from('_health').select('1').single(); // lightweight DB probe
return NextResponse.json({ status: 'healthy' }, { status: 200 });
} catch (err) {
return NextResponse.json(
{ status: 'unhealthy', error: (err as Error).message },
{ status: 503 }
);
}
}
Then configure your platform to use it:
- AWS ALB: Target Group → Health check path:
/api/health - Kubernetes:
livenessProbe.httpGet.path: /api/health - Vercel: no native load balancer health check, but use Uptime Robot against this endpoint
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Deployment Readiness Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · reliability.availability — Availability — health check enables load balancer to route away from unhealthy instances
- nist:rev5 · SI-6 — Security and Privacy Function Verification
- soc2:2017 · A1.2 — Environmental protections, backup, and recovery infrastructure
Taxons
History
- 2026-04-18·v1.0.0·Initial import from deployment-readiness·automated
- 2026-07-06·v1.0.1·Add SOC 2 TSC mapping (A1.2) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2