Belagra

About the website

A catalogue of food-processing equipment from several manufacturers. Buyers can compare products side by side and read about supply, commissioning and service before sending an enquiry.

What I did

• The selected equipment is passed into the enquiry automatically.
• A local online assistant through the company’s own Telegram bot.
• Comparison only between machines of the same type, so there is less irrelevant information when choosing.
• An option to attach a ready specification or drawing instead of retyping the requirements into the form.
• Search by equipment names, descriptions and tags in the chosen language. If nothing is found, the visitor is offered help with selection instead of hitting a dead end.

Website CMS

• Built-in analytics: visits, sources, popular pages, enquiries and conversion, with period comparison.
• Built-in CRM: responsible manager, next step, contact date, potential deal value and notes. Planned and overdue actions are shown separately.
• Enquiry delivery control: an enquiry is saved before it is sent to Telegram. If the notification fails, it stays in the panel marked as undelivered.
• QR code generator: codes for equipment pages, catalogues and printed materials can be created and downloaded.
• Image converter: conversion to WebP, JPEG and PNG, quality settings, resizing and a before-and-after file size comparison.
• Tools for preparing content: a unit converter, find and replace, duplicate line removal, a word counter and a favicon generator.
• Bulk catalogue updates from Excel: CSV/XLSX import with a preview of changes instead of editing every product by hand.
• Catalogue quality check: finds missing photos, empty specifications, translation and SEO issues, with a link to the right product.
• A protected admin panel: extra access verification, passwords stored as hashes and a log of staff actions.

Security

Before handing the project over to the client, an internal grey-box security audit was carried out.

Result: No critical, high or medium vulnerabilities were found in the final build of the project.

Protection against SQL and command injection

• Test: Automated parameter testing with sqlmap plus manual fuzzing of input forms.
• How it is protected: The source code never builds SQL queries by joining strings. The framework’s built-in ORM escaping is used. The application’s database access is limited to Data Reader/Writer rights, with no access to system tables.

Protection against XSS

• Test: Attempts to inject malicious JS scripts into every user text field.
• How it is protected: A strict template engine with automatic escaping of HTML entities. A strict Content Security Policy (CSP) on the web server blocks any third-party or unsafe inline code.

Component security

• Test: Software composition analysis (SCA) with Snyk and Dependency-Check.
• How it is protected: All packages are pinned to stable versions with no known vulnerabilities in the NVD database. Automatic notifications are set up for security patches to dependencies.

Admin panel isolation

• How it is protected: The admin panel is moved to a separate subdomain, hidden from search engine crawlers and protected from brute force by Fail2ban (the IP is blocked after 5 failed attempts). Signing in to the admin panel requires two-factor authentication (2FA / TOTP).

Resilience to DDoS and load

• Test: Stress testing with k6, simulating a legitimate surge of users and HTTP flood attacks.
• How it is protected: Request limits (limit_req) are set in Nginx and return error 429 when one IP exceeds them. The architecture is ready for seamless integration with external services (for example, Cloudflare / Qrator) to filter L4/L7 traffic.