HackYeah 2026 ReviewSplot - Małopolski Hub Innowacji Społecznych (HubMi)
Flip & Flap · daenyall/Hubmi
Council score
Median of 3 models, weighted by the task's official criteriaAn exceptionally engineered, near-complete seven-module HubMI prototype with real Gemini/pgvector matchmaking and best-in-class accessibility practice, undone at review by a dead demo link and the absence of the required video, deck and mockups that would let the jury see it work.
All seven modules exist in both backend and UI and the mandatory matchmaking is real: Gemini embeddings with pgvector, verified in E2E tests, not a hardcoded list. The median reflects a real but unverifiable-live product: the public demo returns HTTP 402 and some features sit behind disabled flags, which supports staying below B's 9.5.
The stack is genuinely deployable — FastAPI, Supabase with RLS and role-based auth, 12 migrations, TCO estimate, deployment guide and 321 tests. Stage-3 docs record real auth weaknesses (client-supplied X-Admin-Role header, JWT decoded without signature verification) and no live environment proves the later fixes, which supports B's lower reading over A's 8.5.
Unusually strong, evidence-backed WCAG 2.1 AA work: axe-core 0 violations, contrast raised from 2.35:1 to 5.04:1, keyboard paths, ARIA, 375px and 200% zoom without horizontal scroll, all in clear Polish. It is not a full conformity audit, as the team itself notes; C's 8 is lower than this evidence warrants.
MVP quality and codebase are high (19,516 LOC, 321 tests, clean shadcn/ui design), but the measured evidence shows zero screenshots, no deck and no video, so the materials half of this criterion collapses. C's 7 is not supported by the evidence; A and B's reading is correct.
Members disagree here: scores range by 2.5 points.Strengths
- All seven HubMI modules are implemented in both backend endpoints and UI screens, mapped explicitly in the README and fully in Polish.
- The mandatory matchmaking is genuine: Gemini 1536D embeddings with pgvector, lexical boost, entropy-based gibberish filtering and why_relevant explanations, verified end-to-end against live Supabase.
- 321 test cases in 34 files, with verification docs that honestly separate real Supabase/Gemini integration from mocked tests and record the team's own failures.
- Security and accessibility practice beyond hackathon norm: RLS isolation tested across author accounts, server-assigned roles, rate limiting, and measured, documented accessibility fixes.
Weaknesses
- The mandatory demo link is dead for judges: splotapp.vercel.app returns HTTP 402 behind Vercel protection, so only local setup demonstrates the product.
- Required deliverables are missing: no MP4 video, no PDF deck, no UX/UI mockups and zero screenshots anywhere in the evidence.
- Stage-3 docs record backend auth weaknesses — a client-chosen X-Admin-Role header and JWT decoded without signature verification; later docs claim fixes but nothing publicly reachable confirms them.
- Several features are gated behind environment flags disabled by default pending an integration contract, and live behaviour rests mainly on the team's own verification reports.
Red flags
- Deployment was never publicly reachable during the event (dead trycloudflare tunnel, onrender 404, then the Vercel login wall) even though a working demo link is mandatory.
- Heavy AI-agent-assisted development is evident from AGENTS.md and CLAUDE.md in the repo, but AI tool use is not disclosed on the form as the rules require.
- The form claims full WCAG 2.1 AA compliance while the team's own docs correctly state that axe scans are not a conformity declaration — an overstated claim relative to the evidence.
claude:glm-5.3-flash77.090% agreedots-studio/dots-3-note-preview:free80.090% agreeinclusionai/ling-3.0-flash-sante:free81.260% agreeclaude:glm-5.3–judgeThe council, the evidence pack, the prompts and the queue are all on GitHub. If a review helped you, a star helps other teams find it.