questions · answered

FAQ.

If your question isn't covered, ask in the hackathon Teams chat.

Who can join?

Full-time employees on XContent payroll as of May 1, 2026, who complete SSO acknowledgement (see Rules).

Solo or teams?

Yes — but only 1 person can claim a finding so you'll have to convince them to share the prize.

What's actually in scope?

HAX production environment. The full asset list is published inside the SSO portal. Anything not listed is out-of-bounds — see Rules.

How fast is triage?

Triage runs as capacity allows. Queue and status are visible in your portal / dashboard. Use the hackathon Teams chat for questions.

What if I find something out of scope?

Stop, document, and report it to Simoné.

Can I use AI?

Yes — fuzzers, Claude, Cursor, custom agents, whatever helps. The point is impact, not toolchain purity. Disclose if your repro requires a non-trivial automation to run.

How are duplicates handled?

First valid submission wins the points. Subsequent duplicates earn +5 if they add materially new repro detail. The triage panel resolves ambiguous cases.

When are prizes paid out?

Cash prizes wire within 2 weeks of the awards ceremony. Hardware ships within 4 weeks. Travel for the Black Hat pass is booked through internal travel.

Can I use 0-days I already have?

Only if they're against in-scope targets, undisclosed, and you didn't develop them on company time as part of normal duties. Ask in the hackathon Teams chat before submitting if you're unsure.

Where are the awards held?

In-person at Berlin office Monday May 18 · 13:00 with livestream for remote participants. Drinks at Klunkerkranich after.