Heavy Equipment / Construction
Maluka Earthmovers — CI4 Security Migration
Hardened
Auth System
Middleware
Admin Route Security
Live
Audit Log
Overview
Maluka Earthmovers operates a fleet of earthmoving equipment across Rajasthan and needed their internal operations portal — used for job tracking, machine assignment, and operator management — secured before onboarding new clients with sensitive project data.
The Challenge
The portal was using a custom authentication system with plaintext password storage, no session expiry, and no CSRF protection on login. Role separation between admin and operator accounts was enforced only in the UI — any operator with a direct URL could access admin pages. There was no audit log for sensitive actions.
Our Approach
We conducted a focused security audit of the authentication layer and all admin routes. CI4 Shield was then implemented as a drop-in replacement: bcrypt password hashing, secure session handling, automatic CSRF token injection, and role-based middleware on all admin controllers. An audit log table was added to record all create, update, and delete actions with timestamp and user ID.
Before vs After
| Metric | Before | After | Change |
|---|---|---|---|
| Auth System | Custom/Unsafe | CI4 Shield | Hardened |
| Admin Route Security | None | All routes | Middleware |
| Audit Log | None | All actions | Live |
Client Testimonial
"We did not realise how exposed we were until the audit. Everything is locked down now and we can confidently bring in new clients."
D
Director
Maluka Earthmovers
More Work
