Certification Business Platform

A certification company in the GCC issues thousands of safety and HSE certificates and runs exams, a sales team, finances and outbound around them. Its legacy Laravel system on shared hosting was never designed to scale, and it had a critical flaw: certificate records were addressable by sequential, guessable numbers, so anyone who knew one number could walk the entire database, name by name, photo by photo. Bots were already doing exactly that. Fixing the leak became the doorway to rebuilding the whole business on one platform.

• Certificate records used predictable, sequential IDs (10001, 10002, …), so changing one number in a URL exposed any other holder's personal details, photo and employer: a classic insecure-direct-object-reference (IDOR) flaw.

• It was being actively exploited. Server logs showed 9,746 scraper requests and 1.8 GB of transfer in a single week, with a handful of IPs harvesting records; genuine certificates were being copied and sold to unqualified people.

• The infrastructure was failing too: shared hosting sat at 87% of its inode limit with 26,000+ student photos, an imminent hard stop on issuing new certificates, and the admin console loaded every record at once so it buckled at scale.

• Beyond certificates, exams, the sales pipeline, finances and outbound all lived in separate, mostly manual tools, so the business had no single place to run itself or see what was happening.

1. Migrated the whole system off shared hosting to a modern Next.js stack on a dedicated server, with authorisation checked on every single record access so a holder's data can only be reached by someone allowed to see it.

2. Replaced guessable certificate numbers with a QR-based verification scheme carrying a hidden random secure code, so employers can verify a certificate without ever being able to enumerate the database.

3. Moved 26,000+ photos and all files to Cloudflare R2, ending the inode crisis, and put Cloudflare in front for CDN, DDoS protection, bot filtering and Turnstile CAPTCHA.

4. Made server-side pagination a hard rule (no unbounded queries), added a print/access audit trail, and planned a staged, idempotent data migration with human sign-off on ambiguous records.

5. Grew the secure core into a complete business platform: an exam engine, a sales/CRM module, a finance module and outbound, all on one schema and one permission model.

6. Wove AI through the platform: AI-generated exams and question banks, an AI examiner that now runs 20 to 30 candidates a day, AI fraud detection on verification traffic, an AI outbound assistant that drafts and follows up, and AI insights over the finances.

7. Replaced permanent, guessable links with short-lived verification tokens and layered the rest of the hardening around them, which is what took successful external attacks to zero.

8. Migrated more than 30,000 historic certifications in staged, repeatable batches, with a human checking anything ambiguous rather than letting a script guess.

The leak is closed for good

Every record now checks who's asking before it answers, so no one can browse the database again just by guessing a number.

Certificates can't be faked and pass

A hidden verification code means an employer can confirm a certificate is real without ever exposing another holder's data.

Won't buckle as the archive grows

Record lists load in pages instead of all at once, so admin screens stay fast at thousands of records instead of freezing.

Protected at the edge

Traffic passes through bot and attack filtering before it ever reaches the system, so most abuse is stopped before it matters.

The whole business on one platform

Certifications, exams, sales, finances and outbound share one system, so the company runs and sees everything in one place instead of stitching tools together.

AI does the repetitive heavy lifting

Exams draft themselves, suspicious verifications get flagged, and outbound follow-ups write themselves, so the team spends its time on judgement instead of busywork.

Nothing falls through the cracks in sales

Every enquiry lands in the same pipeline with a follow-up attached, so the leads that used to quietly go cold now get chased.

The pre-launch figures (9,746 scraper requests and 1.8 GB of transfer in 7 days, 87% inode usage, 26,000+ photos) come from the client's own server logs. Since the rebuild, the attack surface that made those numbers possible is gone and successful external attacks sit at zero. The commercial side moved just as fast: with outreach, exams and finances finally in one place, the team built SAR 600,000 of pipeline in a month and closed SAR 250,000 of it, while management got roughly half a working day back.