HackYeah 2026 ReviewCouncil score
Median of 3 models, weighted by the task's official criteriaA genuinely implemented WAF with real anomaly detection and a well-guarded AI investigation agent that meets the Defence brief in code, but the absent degraded-scenario demo and complete lack of visual deliverables leave its usability and design unproven.
The WAF-plus-LLM-triage combination is known, but the execution fills a real gap concretely: five named detectors with thresholds, warmup baselines and cooldowns, and an investigation agent restricted to read-only tools that must cite request IDs and mark assessments inconclusive when evidence is empty. C's 'incremental dashboard' reading understates how specific the failure modes are.
Members disagree here: scores range by 2.0 points.This is unambiguously security and resilience work: CRS prevention with per-service policies, earlier detection on a 15-second cycle including an upstream-error detector for failing services, and consequence reduction through investigations and evidence snapshots that survive log pruning. The evidence supports A and B over C's 'generic monitoring tool' reading.
Members disagree here: scores range by 3.0 points.It deploys as a single Go binary with embedded frontend and SQLite, keeps recording detections with no AI key (chat returns 503), and tolerates GeoIP download failure, with acknowledge/resolve/dismiss workflows and SSE progress. C's impracticality claim is overstated by the evidence, though tuning multi-service policies, paranoia levels and anomaly settings is genuinely non-trivial.
Members disagree here: scores range by 2.0 points.The code promises a coherent Nuxt 4 and Tailwind interface with ECharts, EN/PL i18n and severity badges, but zero screenshots, demo captures or deck exist, so visual quality is judged from framework choices alone.
16,277 lines by 3 authors with all 37 commits inside the event window, 27 test files with 66 cases including a gated live AI test, real Coraza rule compilation, SQLite-backed detection and investigation plumbing with crash recovery, and a 6,000-log seed generator. A working prototype, not a mock.
Strengths
- Security-critical logic is genuinely implemented: Coraza 3.8.1 with OWASP CRS 4.25.0 compiled from embedded rules, hot-reloading per-service policies, and custom rule validation with regex and CIDR checks.
- The detection-to-investigation pipeline is real and resilience-aware: 15-second evaluation over aggregated minute buckets, queue and claim execution with five-minute leases and crash recovery, durable SSE event IDs, and evidence snapshots that survive log pruning.
- Strong LLM guardrails: read-only telemetry tools, bounded tool budgets, mandatory request-ID citation, no blocking actions exposed to the model, and inconclusive verdicts when evidence is empty.
- Excellent hygiene for a 24-hour build: argon2id auth with rate limiting, trusted-proxy client-IP handling, graceful shutdown, degraded operation without an AI key, and GeoIP that keeps working when its download fails.
Weaknesses
- The task-required demo of a degraded scenario (services down, incomplete information) is missing: zero demo checks were recorded, and the seed generator produces attacks and benign traffic but not upstream errors or a service-down state, so the scenario exists only in code and docs.
- No deck, no screenshots and no captured demo pages, so the UI, design quality and any end-to-end incident flow cannot be verified from the pack.
- The submission form was left blank, leaving the README as the only self-description.
- AI assessment quality is unverifiable: it needs an external API key and no executed investigation was shown, so triage value rests on tests the jury did not see run.
claude:glm-5.3-flash72.090% agreedots-studio/dots-3-note-preview:free74.0100% agreeinclusionai/ling-3.0-flash-sante:free57.050% agreeclaude:glm-5.3–judgeThe council, the evidence pack, the prompts and the queue are all on GitHub. If a review helped you, a star helps other teams find it.