Belmirotec

About the website

The catalogue is split into poultry processing and sausage packaging. Alongside product pages and projects, a savings calculator lets buyers estimate the return before they request a quote.

What I did

• The calculator turns equipment specifications into potential savings for a specific production line.
• The quote request opens on the left of the current page, so the buyer can get in touch without leaving the machine page.
• The equipment or page topic is filled into the enquiry automatically.
• Contact details are filled in automatically, so there is less to type by hand.

Website CMS

• Analytics next to enquiries: traffic, sources and interest in equipment pages are available in the same panel where the manager works.
• Figures passed to the CRM: the current month is compared with the same number of days of the previous one, so a partial period is not compared with a full one.
• Enquiry handling: statuses, manager notes and the enquiry is saved before the Telegram notification is sent.
• Equipment and pages are edited without code: specifications, configurations, photos, materials and projects.
• Verified publishing: a draft, a preview and a build check before the site is updated.
• Protection against losing edits: conflict control for simultaneous editing, backups and recovery.
• A closed admin area: extra access verification, signed sessions, and enquiries and internal data stored outside the public part of the site.

Security

Before handing the project over to the client, an internal grey-box security audit was carried out.

Result: No critical, high or medium vulnerabilities were found in the final build of the project.

Protection against SQL and command injection

• Test: Automated parameter testing with sqlmap plus manual fuzzing of input forms.
• How it is protected: The source code never builds SQL queries by joining strings. The framework’s built-in ORM escaping is used. The application’s database access is limited to Data Reader/Writer rights, with no access to system tables.

Protection against XSS

• Test: Attempts to inject malicious JS scripts into every user text field.
• How it is protected: A strict template engine with automatic escaping of HTML entities. A strict Content Security Policy (CSP) on the web server blocks any third-party or unsafe inline code.

Component security

• Test: Software composition analysis (SCA) with Snyk and Dependency-Check.
• How it is protected: All packages are pinned to stable versions with no known vulnerabilities in the NVD database. Automatic notifications are set up for security patches to dependencies.

Admin panel isolation

• How it is protected: The admin panel is moved to a separate subdomain, hidden from search engine crawlers and protected from brute force by Fail2ban (the IP is blocked after 5 failed attempts). Signing in to the admin panel requires two-factor authentication (2FA / TOTP).

Resilience to DDoS and load

• Test: Stress testing with k6, simulating a legitimate surge of users and HTTP flood attacks.
• How it is protected: Request limits (limit_req) are set in Nginx and return error 429 when one IP exceeds them. The architecture is ready for seamless integration with external services (for example, Cloudflare / Qrator) to filter L4/L7 traffic.