Boxed Bitrix24 security and an audit trail for regulatory requirements
The financial company's boxed Bitrix24 had been accumulating scripts for years: some of them handed out an administrator session on an anonymous request, the API let requests through without a token, credentials sat in the code, and logs with IINs and phone numbers piled up without rotation. Meanwhile, the financial regulator's audit-trail requirements were not being met.
Production cannot stop, and dozens of integrations depend on the current behavior; auditing had to be enabled by flags with safe defaults, and personal data must end up neither in responses nor in logs.
- Closed 6 places that issued an admin session on an anonymous request and an authorization bypass in 6 API endpoints; stack traces removed from responses
- Anonymous endpoints got rate limiting, the IIN is validated before paid external calls; IDOR and CSRF closed in working interfaces
- The login-form password is encrypted in the browser (RSA-OAEP, 4096-bit key); about 50 hardcoded credentials moved to .env
- An audit trail behind flags: failed logins, an API call log, a syslog mirror; a daily watchdog for log rotation and for regressions of mandatory 2FA
- The logger masks IINs, phones and cards; 90-day rotation plus a 400-day archive; false masking of hashes cut from 5.1% to 0% on 200,000 values
- A log viewer with charts and cross-log search by request id; a health API catches error spikes against the median, silence and stalled rotation
Accumulated logs were archived: 6,344 files totaling 2,041 MB compressed into a 120 MB archive with checksums, and the local/ directory shrank from 2.6 GB to 578 MB. Critical access holes are closed, and the logs show incidents rather than noise.