Event Technology_MePassAdmin security hardening

Hardening an event platform’s admin access with TOTP MFA_

Parallaxis removed hardcoded test identities and OTPs, added Google Authenticator-compatible TOTP, tightened login flows, and verified protected administrative actions end to end. The admin surface now requires a second

Admin MFA implementation
TOTP enrollment and verification
Removal of test bypasses

Challenge_

Administrative accounts could access payments, organiser data, ticket operations, and configuration. Test shortcuts and single-factor login created risk far beyond the convenience they offered.

Approach_

Parallaxis removed hardcoded test identities and OTPs, added Google Authenticator-compatible TOTP, tightened login flows, and verified protected administrative actions end to end.

Outcome_

The admin surface now requires a second factor and no longer depends on test bypasses that could leak into production behavior.

Overview

Administrative accounts could access payments, organiser data, ticket operations, and configuration. Test shortcuts and single-factor login created risk far beyond the convenience they offered.

Parallaxis removed hardcoded test identities and OTPs, added Google Authenticator-compatible TOTP, tightened login flows, and verified protected administrative actions end to end.

The engineering decision

MFA was implemented as part of a full authentication path: secret enrollment, confirmation, recovery handling, rate limits, session controls, and audit visibility all matter.

How the system works

The implementation separates intake, validation, state changes, side effects, and reporting. That separation makes failures visible and allows one layer to change without rewriting the entire workflow.

Operational users see explicit statuses and exceptions; technical teams retain identifiers, timestamps, versions, and logs needed to reproduce a result.

Outcome