About the website
Guides answer the questions readers ask about skins: prices, float, marketplace fees and common scams. Newcomers start with an intro guide and a glossary, then follow links to specific topics.
What I did
- Full-text search that understands the names players actually use: “flo”, “float”, “steam” and “pattern” find the right article without knowing the exact spelling of a term.
- A separate route for newcomers helps them start without knowing the terminology.
- From a term’s explanation, readers can go straight to a detailed guide.
- Recommendations for what to read next give a clear way to continue after an article.
Website CMS
- A separate report in the shared analytics panel: views, sessions, clicks, scrolling and active time.
- Time is counted only in the active tab, so an article left open in the background is not counted as continuous reading.
- A feed of individual events: you can see which pages and elements readers used, and export the statistics.
- Content is edited in the shared panel: texts, images and SEO, with drafts and preview.
- Editorial work is protected: closed access, change history and restoring earlier versions.
Security
Before handing the project over to the client, an internal grey-box security audit was carried out.
Result: No critical, high or medium vulnerabilities were found in the final build of the project.
Protection against SQL and command injection
- Test: Automated parameter testing with
sqlmapplus manual fuzzing of input forms. - How it is protected: The source code never builds SQL queries by joining strings. The framework’s built-in ORM escaping is used. The application’s database access is limited to
Data Reader/Writerrights, with no access to system tables.
Protection against XSS
- Test: Attempts to inject malicious JS scripts into every user text field.
- How it is protected: A strict template engine with automatic escaping of HTML entities. A strict Content Security Policy (CSP) on the web server blocks any third-party or unsafe inline code.
Component security
- Test: Software composition analysis (SCA) with
SnykandDependency-Check. - How it is protected: All packages are pinned to stable versions with no known vulnerabilities in the NVD database. Automatic notifications are set up for security patches to dependencies.
Admin panel isolation
- How it is protected: The admin panel is moved to a separate subdomain, hidden from search engine crawlers and protected from brute force by
Fail2ban(the IP is blocked after 5 failed attempts). Signing in to the admin panel requires two-factor authentication (2FA / TOTP).
Resilience to DDoS and load
- Test: Stress testing with
k6, simulating a legitimate surge of users and HTTP flood attacks. - How it is protected: Request limits (
limit_req) are set in Nginx and return error 429 when one IP exceeds them. The architecture is ready for seamless integration with external services (for example, Cloudflare / Qrator) to filter L4/L7 traffic.