About the Client
Rebello is an e-commerce platform operating in the mobile buyback and resale market space. The platform serves as a customer-facing e-commerce application where users buy and sell devices, requiring robust security handling for transactions, user documentation, and administrative operations. The client approached us to dramatically improve the security posture of their application after multiple critical security vulnerabilities and risks were identified across their codebase, dependencies, authentication workflows, and data handling processes.
Challenges
During the security remediation project, several critical application and infrastructural challenges were encountered:
- Multiple Security Vulnerabilities: The application contained severe flaws across authentication, authorization, third-party dependencies, and sensitive data handling, requiring a systematic remediation approach.
- Maintaining Existing Functionality: Security fixes had to be implemented seamlessly without disrupting existing business workflows, causing application downtime, or negatively impacting the user experience.
- Legacy Code & Technical Debt: Parts of the application followed outdated coding practices, making secure refactoring complex and error-prone.
- Dependency Risks: Several third-party packages and core application libraries contained known vulnerabilities, requiring careful upgrades while maintaining backward compatibility.
- Access Control Complexity: Strengthening Role-Based Access Control (RBAC) required consistent authorization checks across all APIs, frontend views, and backend user roles.
- Sensitive Data & Document Exposure: Hardcoded secrets, API keys, and configuration values were exposed. Furthermore, newly uploaded user documents were fully public and accessible to anyone via direct URL manipulation.
- Comprehensive Testing Constraints: Every security enhancement required extensive functional, regression, and security testing to ensure vulnerabilities were eliminated without introducing regression bugs into production.
Tech Stack Overview
- Frontend: ReactJS (1 Developer)
- Backend: Node.js (1 Developer)
- Database: MySQL
- Project Management & Architecture: 1 Business Analyst (BA)
- Timeline: 2 Weeks
Solutions
To address the identified security risks and strengthen the application’s overall security posture, we implemented the following solutions:
- Comprehensive Security Assessment: Conducted a detailed security review utilizing Snyk scanning to identify architectural flaws and vulnerable packages across the application, prioritizing remediation based on risk severity.
- Strengthened Authorization & RBAC Controls: Implemented robust server-side authorization checks and enhanced Role-Based Access Control (RBAC). This restricted user view access strictly to issues and data relevant to their role, eliminating privilege escalation risks.
- Secure Authentication & Session Management: Replaced weak configurations with modern tokenization for login workflows. Improved JWT token validation, session handling, and authentication workflows to eliminate session hijacking and unauthorized access.
- Sensitive Data & Upload Isolation: Fixed the file-upload vulnerability by using Node.js logic to convert public document directories to private storage. Implemented admin password restrictions and secure URL access parameters to guarantee that sensitive documents are protected from unauthorized public exposure.
- XSS & SSRF Mitigation: Applied secure HTML/JavaScript input validation and sanitization, output encoding, request validation, and endpoint restrictions to safeguard the platform against Cross-Site Scripting (XSS) defacement/hacking and Server-Side Request Forgery (SSRF).
- Dependency & Package Upgrades: Reviewed all flags reported by Snyk security scanning, systematically upgraded insecure third-party libraries, and replaced outdated, vulnerable packages with stable, secure versions.
- Secure Logging & Secret Hardening: Removed hardcoded secrets, API keys, and configurations from the codebase, transitioning them to secure, environment-level variables. Sanitized application logs and error responses to prevent internal infrastructure leakage.
- Performance-Optimized Code Refactoring: Refactored legacy vulnerable code using OWASP secure coding guidelines, which unexpectedly yielded structural code optimizations—greatly accelerating front-to-back e-commerce website load speeds post-tokenization.
Results
| Metric Component | Before Solution (Legacy / Manual Processes) | After Solution (Platform Deployment) | Operational Impact |
| Document Security & Access | Uploaded documents accessible to everyone via public URLs. | Node.js routing layer makes uploads private; enforced via admin passwords. | 100% elimination of unauthorized document exposure and data leaks. |
| Authentication Protocols | Weak, non-tokenized, or legacy login session validation. | Strict tokenization implemented for user and admin login states. | Safe, un-hijackable active user sessions across the web application. |
| Role-Based Access Control | Broad authorization flaws permitting horizontal/vertical bypass. | Granular RBAC where users can “only see issues” and specific features. | Zero unauthorized cross-account visibility; strictly enforced data boundaries. |
| Dependency Vulnerability | Outdated third-party packages flaggable by Snyk scans. | Complete dependency audit and upgrade to secure versions. | Eradication of underlying architectural and library-based exploits. |
| Frontend Code Resilience | Vulnerable to JavaScript/HTML injection and style hacking. | Strict input sanitization and secure output encoding on the client-side. | Shielded UI elements against web-style hacking and data defacement. |
| Platform Speed & Performance | Legacy code structures slowing down frontend interactions. | Refactored, tokenized code structure optimized for fast data parsing. | Significant increase in e-commerce page speeds and operational efficiency. |
Core Features Delivered
A. Multi-Layered Data Guardrails & RBAC
- Privileged Logging Environments: Secure login workflows fortified with JWT-based tokenization to track user access patterns cleanly.
- Feature Truncation: Enforced structural visibility parameters so end-users see clean dashboards dedicated exclusively to resolving open tickets or checking out order flows without looking at extraneous administrative elements.
B. Document Isolation Framework
- Secured Endpoint Pipelines: Restructured the document-ingestion architecture to move critical user identity documents out of public-facing web folders into isolated server buckets.
- Administrative Access Gates: Added password verification barriers on top of node-validated session requests to ensure files open only for certified auditors.
C. Web Application Attack Resiliency
- Snyk-Compliant Package Tree: Cleaned the overall technical debt of the repository by updating deeply nested node modules to safe, non-vulnerable baseline points.
- Sanitized Request Vectors: Front-to-back filtering of user text fields to neutralize executable scripts, ensuring malicious scripts do not persist inside the MySQL production database.
Conclusion
By deploying a dedicated ReactJS and Node.js security remediation initiative within a rapid 2-week timeline, the engineering team transformed Rebello (Renewable Care) from a vulnerable web environment into a highly resilient, enterprise-grade e-commerce application. What began as an application hampered by technical debt, public data leaks, and insecure package versions is now an optimized system that aligns closely with OWASP Top 10 recommendations. The engagement not only fortified the platform against modern web exploits but also drastically improved client confidence, user document privacy, and core web application rendering speeds
