HACKTOBER 2026 — National Event Management Platform

A national-level, multi-day event needs more than a landing page: public registration across five competitions, dynamic multi-event pricing, payment verification, attendance tracking, and an administrative back office — all handling real participant data that must stay private and tamper-resistant.

The public portal runs a multi-step registration wizard with a dynamic pricing engine (₹79 for one event up to ₹350 for five) and semester constraints. Each confirmed registration gets a non-sequential ID (`HT26-` + 6 random characters) and a printable accreditation pass.

Rather than encoding participant PII in the QR code, the pass carries an HMAC-SHA256 signed token (`HT26-XXXXXX-<hmac>`). A public verification route confirms authenticity, college, events, and payment status without leaking phone or email.

The admin side is treated as an attack surface. It uses a role-based hierarchy (SUPER_ADMIN > ADMIN > VIEWER), a sliding-window brute-force lockout (5 failed attempts → 15-minute block, HTTP 429), constant-time comparison to mitigate timing attacks on login, HttpOnly session cookies, and strict security headers (`X-Frame-Options: DENY`, `nosniff`, `no-store`).

Organizers get a live analytics dashboard, a payment-verification queue with side-by-side receipt review, a camera-based QR attendance scanner with duplicate check-in detection, filter-aware CSV/Excel exports, and an immutable audit log.

The platform ships with a unit and business-rules suite (50/50 passing) covering pricing, event limits, semester constraints, rate limiting, HMAC tokens, RBAC, and the payment lifecycle, plus a live HTTP end-to-end suite (8/8 passing) exercising registration, QR verification, payment approval, attendance check-in, and exports.