Rules & scoring
Short, because there are only a few things that matter. Anything unclear belongs on the discussion board.
Scoring
Read straight off the pull request Nadhi wrote, so there is nothing to self-report and nothing to argue about.
| What | Why it counts | Points |
|---|---|---|
| critical finding fixed | Live credentials, auth bypass, remote execution | 10 |
| high finding fixed | Broken access control, unverified tokens, wildcard CORS | 6 |
| medium finding fixed | Weak crypto, unsafe defaults, missing validation | 3 |
| low finding fixed | Information leaks, noisy logs, hygiene | 1 |
| You merged it | You read the diff and shipped it to your own main branch — the fix is live, not just proposed. | ×1.5 |
| First 24 hours | Submitted within a day of opening. | ×1.25 |
Ties go to whoever submitted first.
Prizes
Paid once we have reviewed the diff by hand.
A Lifetime Nadhi Audit licence for anyone whose pull request verifies. The 1-year licence is already free to everyone, so entrants get the upgrade instead.
The first entry merged into a main branch gets its own post.
Schedule
| Phase | Dates (IST) | What happens |
|---|---|---|
| Submissions open | 15 August — 24 August | Audit a repository you own, let Nadhi open the pull request, submit the link. The board scores it the moment it verifies. |
| Judging | 25 August — 26 August | Entries close. We read the top diffs by hand against the findings they claim — automatic scoring orders the board, a human signs the cheque. |
| Results | 27 August | Winner announced here and on Product Hunt. Licences go out to everyone whose entry verified. |
Rules
Your own repositories. The pull request must target a public repo you own. We are not paying people to send automated patches to maintainers who never asked for them — that is how Hacktoberfest 2020 became a spam event, and no prize is worth doing that to open source. Maintain an organisation repo? Email us and we will add it by hand.
Real findings only. Fixes to test fixtures, seed data and sample credentials are excluded. Nadhi already declines most of them, and we check the rest by hand.
The repo has to predate the challenge. Checked automatically against its creation date. A repository stuffed with planted secrets an hour before you enter is a score, not a security fix.
One counted entry per person. Submit more if you like; only your best verified pull request is scored.
The top entries are read by a human before any money moves. Automatic scoring orders the board; it does not sign the cheque.
Nothing here depends on a Product Hunt vote. We would love your support there, but votes are not rewarded, counted or checked — that is their rule and ours.