Mirozdanie

About the website

One catalogue for meat, poultry, fish, vegetable and packaging equipment. Buyers can search by production task, by specification or by turnkey solution, and request a proposal or leasing terms.

What I did

• The enquiry is filled in from the page automatically, so the customer does not have to type it.
• Ready-made enquiries for buying, finding an equivalent and ordering spare parts.
• Name, company, phone and email can be filled in automatically by the browser.
• Comparison with a “Differences only” mode and saved machine selections.
• Search by model, manufacturer and production task, with extra filters. The search settings are kept in the link, so a shortlist can be shared.

Website CMS

• Built-in analytics: traffic, sources, popular pages, pages per visit, time on site, bounces, enquiries and conversion.
• CRM with contact planning: responsible manager, next step, date, deal potential and manager’s comment; overdue actions are highlighted.
• Working tools inside the panel: a QR code generator, image conversion and resizing, and a unit converter.
• Bulk catalogue updates: spreadsheet import with a preview of changes, and export for working in Excel.
• Specifications copied from spreadsheets: parameters can be pasted straight from Excel or Google Sheets instead of filling in each row separately.
• Heavy image control: the media library helps find files worth optimising.
• Separate staff access: an editor works with the site content, while account management stays with the administrator; login attempts are limited and editing commands are protected.

Security

Before handing the project over to the client, an internal grey-box security audit was carried out.

Result: No critical, high or medium vulnerabilities were found in the final build of the project.

Protection against SQL and command injection

• Test: Automated parameter testing with sqlmap plus manual fuzzing of input forms.
• How it is protected: The source code never builds SQL queries by joining strings. The framework’s built-in ORM escaping is used. The application’s database access is limited to Data Reader/Writer rights, with no access to system tables.

Protection against XSS

• Test: Attempts to inject malicious JS scripts into every user text field.
• How it is protected: A strict template engine with automatic escaping of HTML entities. A strict Content Security Policy (CSP) on the web server blocks any third-party or unsafe inline code.

Component security

• Test: Software composition analysis (SCA) with Snyk and Dependency-Check.
• How it is protected: All packages are pinned to stable versions with no known vulnerabilities in the NVD database. Automatic notifications are set up for security patches to dependencies.

Admin panel isolation

• How it is protected: The admin panel is moved to a separate subdomain, hidden from search engine crawlers and protected from brute force by Fail2ban (the IP is blocked after 5 failed attempts). Signing in to the admin panel requires two-factor authentication (2FA / TOTP).

Resilience to DDoS and load

• Test: Stress testing with k6, simulating a legitimate surge of users and HTTP flood attacks.
• How it is protected: Request limits (limit_req) are set in Nginx and return error 429 when one IP exceeds them. The architecture is ready for seamless integration with external services (for example, Cloudflare / Qrator) to filter L4/L7 traffic.