BonCard Hub is a secure web application...
BonCard Hub is a secure web application built with Laravel 11 and Laravel Breeze (Blade & Tailwind CSS) designed for managing internal gift cards, tracking their live balances, and maintaining a robust system audit log.
The application has been fully patched against security threats including Stored Cross-Site Scripting (XSS) and Privilege Escalation, ensuring that all input handling and server-side operations follow industry-standard security practices.
Follow these step-by-step instructions to get the application up and running on your local machine from scratch.
Make sure you have the following installed on your system before starting:
- PHP >= 8.2
- Composer (PHP package manager)
- Node.js & NPM (For frontend assets compilation)
- MySQL or MariaDB database server (e.g., via XAMPP, Laragon, or Docker)
Clone this project to your local directory by providing the repository URL, then enter the project folder: git clone https://github.com/kacpero177/boncard-hub.git cd boncard-hub
Run Composer to download and install all required Laravel framework packages: composer install
Download and compile the CSS and JavaScript assets necessary for the login layouts and Tailwind framework styling: npm install
Create your local environment configuration file by copying the template file: cp .env.example .env
Now, open the newly created .env file in your code editor and update the database credentials to match your local server environment: DB_CONNECTION=mysql DB_HOST=127.0.0.1 DB_PORT=3306 DB_DATABASE=boncard_db DB_USERNAME=root DB_PASSWORD=
(Note: Make sure to create an empty database named boncard_db in your database manager like phpMyAdmin prior to running migrations).
Laravel requires a unique application key to encrypt user sessions and secure cookies: php artisan key:generate
Create the necessary database tables (including users, password resets, cards, and transaction logs) by executing database migrations: php artisan migrate
Compile the assets and launch the Vite build system to handle frontend development styling: npm run dev
Once the installation is complete, you can launch the local development server by executing: php artisan serve
The terminal will provide a local address. Open your web browser and navigate to: 👉 http://127.0.0.1:8000
- Authentication: Full login, registration ("Register new account"), and password management built via secure Breeze scaffolding.
- Access Control: All critical routes /cards/* are fully protected via the server-side auth middleware, restricting public access.
- Secure Audit Trail: Every card modification triggers an untamperable database transaction event logging details securely.
- XSS Protection: Output sanitization implemented inside show.blade.php timeline nodes preventing payload command execution.