Why Bangladeshi SMEs Lose Customer Data (And How to Secure Your Web Apps Without Enterprise Budgets)

A few months ago, a diagnostic center owner reached out to us because they wanted to upgrade their patient portal. Before writing a single line of new code, we ran a quick security check on their existing web application—a system built two years earlier by a low-cost vendor.

Within three minutes, we realized anyone with a web browser could download every patient’s lab report in their database.

There was no sophisticated hacking involved. The application simply used sequential URLs like /reports/view?id=4012. Changing 4012 to 4011 immediately loaded another patient’s confidential medical report—no login or permission check required.

In cybersecurity, this is called an IDOR (Insecure Direct Object Reference) vulnerability. In the local software market, it is terrifyingly common.

When people hear about cybersecurity in Bangladesh, they usually picture massive bank heists or nation-state attacks. The reality for small and medium enterprises (SMEs)—hospitals, schools, hotels, and growing e-commerce brands—is much simpler: most data breaches happen because basic engineering guardrails were skipped to cut development costs.

At Vivago Technologies, while auditing legacy systems and building platforms like MicroCampus and LodgeOS, we’ve seen the exact same vulnerabilities repeat across industries. Here is what actually puts local businesses at risk—and the practical security baseline every company should enforce.

---

What Are the Most Common Security Vulnerabilities in Local Web Apps?

The five most frequent security flaws in SME software across Bangladesh are Broken Access Control (IDOR), shared admin credentials without audit logs, exposed environment (.env) files, unencrypted local-only backups, and unvalidated SQL inputs.

Unlike advanced zero-day exploits, these flaws exist because applications are rushed into production without proper code reviews or role-based permission layers.

1. Predictable URLs & Broken Object-Level Authorization (IDOR)

Many custom ERPs and customer portals rely on auto-incrementing database IDs (101, 102, 103) in their API endpoints and page URLs. If the backend checks whether a user is logged in, but forgets to check whether that specific user owns that specific record, any logged-in user—or even an unauthenticated visitor—can scrape your entire invoice history, student database, or customer phone list.

The Fix:

• Never rely on frontend hiding to protect data. Every backend API route must verify ownership (WHERE record_id = ? AND organization_id = ?) using the authenticated session token.
• Replace predictable sequential IDs in public-facing URLs (like invoice links or diagnostic report downloads) with non-guessable UUIDs or cryptographically signed tokens.

2. Shared Admin Passwords and Missing Audit Trails

In many retail shops, clinics, and hotels, three different front-desk staff members log into the billing software using the exact same admin username and password.

When an invoice is deleted, a discount is retroactively applied, or cash records don't match at the end of a shift, management has zero way to know who made the change—or when it happened.

The Fix:

• Enforce individual user accounts with Role-Based Access Control (RBAC). A receptionist should be able to generate a bill, not void yesterday’s paid invoices.
• Maintain immutable audit logs for sensitive actions (price edits, refunds, record deletions, permission changes) recording the user_id, timestamp, IP address, and the before/after values.

3. Exposed Configuration Files & Hardcoded Secrets

When cheaper web apps are deployed on shared hosting or unmanaged VPS servers, developers frequently leave .env files publicly accessible, commit database passwords into Git repositories, or leave database ports (3306 or 5432) open to the public internet. Automated bots scan the internet 24/7 for these exact misconfigurations and compromise servers within hours of deployment.

The Fix:

• Restrict web server root directories so configuration files and .git folders are never served over HTTP.
• Bind databases to localhost or a private VPC network so they cannot be queried directly from outside the application server.

4. The "Single-Server Backup" Illusion

Having a daily backup saved in a folder on the same server (or on a receptionist's desktop D:\ drive) is not a backup strategy. If that server crashes, gets corrupted, or is hit by ransomware, your live database and your backup disappear together.

The Fix:

• Follow the 3-2-1 backup principle: automate daily database dumps, compress and encrypt them, and ship them automatically to an isolated off-site cloud storage bucket. Just as importantly, set up automated alerts so your engineering team knows immediately if a nightly backup fails.

5. Plaintext Passwords & Weak Session Handling

Storing user passwords in plain text—or using outdated hashing algorithms like MD5—means a single database leak compromises every staff and customer account. Similarly, storing authentication tokens in browser localStorage leaves sessions vulnerable to Cross-Site Scripting (XSS) attacks.

The Fix:

• Hash all passwords using bcrypt or Argon2 with proper salting.
• Store session tokens in HttpOnly, Secure, SameSite=Strict cookies so malicious scripts cannot read them.

---

A Practical Security Checklist Before You Sign Off on Any Software

You don’t need a massive enterprise compliance budget to protect your business. If you are hiring an agency or an in-house team to build a custom web app, ERP, or portal, require these six non-negotiables before final handover:

1. Enforced HTTPS (TLS) Everywhere: Zero unencrypted HTTP traffic, including internal admin panels.
2. Parameterized Queries / Modern ORMs: Complete protection against SQL injection by never concatenating raw user input into database queries.
3. API Rate Limiting: Throttling login endpoints and SMS OTP triggers so bots cannot brute-force passwords or drain your SMS gateway balance overnight.
4. Strict File Upload Validation: Verifying actual MIME types and storing uploaded files (NIDs, prescriptions, PDFs) outside the executable web root so attackers cannot upload malicious scripts.
5. Automated Off-Site Encrypted Backups: Tested restoration drills—because an untested backup is just a guess.
6. Dependency & Server Patching: Keeping Node.js, PHP, PostgreSQL, and OS security packages updated on a predictable schedule.

---

Frequently Asked Questions (FAQ)

How much does basic cybersecurity add to custom software development costs?

Implementing foundational security—proper RBAC, UUIDs, encrypted backups, parameterized queries, and secure authentication—adds roughly 10% to 15% to initial development time. Fixing a data breach or rebuilding a compromised database after launch typically costs five to ten times more, not counting the permanent loss of customer trust.

Is cloud hosting safe for Bangladeshi hospitals, schools, and businesses?

Yes—when configured properly. Reputable cloud infrastructure with encrypted disks, private networking, firewall rules, and automated off-site backups is significantly safer than an unmonitored physical desktop PC sitting in an office where anyone can plug in a USB drive.

How can a business owner check if their current software has security gaps?

Start by asking your vendor three direct questions: Where are our database backups stored, and when was the last test restore? Does every staff member have an individual login with an activity log? Are patient/customer files protected behind authentication checks rather than public URLs? If they cannot give clear answers, schedule an independent code and infrastructure audit.

---

Final Thoughts

Good software isn't judged by how sleek the dashboard looks during a sales pitch—it's judged by how reliably it protects your business data when things go wrong. Security isn't an optional "add-on" you buy after growing big; it is the foundation that allows a business to scale safely in the first place.

At Vivago Technologies, security-first architecture, automated off-site backups, and strict role-based access control are built into every custom web application and SaaS platform we ship. If you’re planning a new system or want an honest technical audit of your existing software, feel free to connect with our team.