BeyondBug is an MIT-licensed hackathon submission and judging platform built for DOGFOOD 2026. Its author, kadhiravan, describes it in a DEV Community article published September 29, 2026. Two of its design claims matter most. First, a severity-adjusted scoring model can reorder a ranking when judges score strictly or generously. Second, access rules are enforced in the backend rather than in the interface.
The project’s own figures support the first claim only as a reproducible demonstration on one reference event dataset. The second is a described design that has not been checked by an external security audit. The machine-learning component is an advisory review queue, and its accuracy figures come from simulated data only. The sections below separate those levels of evidence.
As an Amazon Associate I earn from qualifying purchases.
What BeyondBug covers and who holds which role
The platform is meant to run the whole life of a hackathon: event setup, registration, teams, submissions, judging, community voting, results publication, feedback, awards and certificates. It is designed for self-hosting, so the organizing group runs it on its own machine.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe article separates five roles: visitor, participant, judge, organizer and administrator. Roles are event-specific, which means one account can hold different permissions in different events. The author’s examples focus on how judges, participants and organizers are separated:
- Judges can read and score only the projects assigned to them.
- Participants are refused access to the peer-score routes.
- Organizers are the only role authorized to run rankings and exports.
How the ranking responds to judge severity
The raw score
Each project receives criterion scores from 0 to 5. Those scores are combined using positive weights that the organizer sets for each criterion. This weighted result is the raw ranking, and it is the figure a simple average-style process would produce.
The severity-adjusted model
The second step is a regularized two-way additive model. It estimates two things at once: the quality of each project and the severity of each judge. Each review is then adjusted for the estimated severity of the judge who gave it. The original scorecard is kept unchanged, so an organizer can always compare the raw and adjusted results.
The stated purpose is to make a strict or generous panel’s tendencies visible and open to inspection. The article does not present the correction as a discovery of objective truth.
Reference fixture results
The project’s official fixture contains 41 project records from 40 teams. One duplicate was deliberately included and excluded, leaving 40 ranked projects. The fixture holds 126 historical scorecards, of which 122 are completed reviews. It includes 30 judges who are linked together in one connected overlap component, and one judge who gives the same score every time.
The article reports the following movement. Adjusted scores are shown only where the article states them.
| Project | Raw rank | Adjusted rank | Adjusted score |
|---|---|---|---|
| Iron Switch | 2 | 1 | 4.316 |
| Salt Ledger | 1 | 2 | 4.295 |
| Dry Relay | 4 | 3 | 4.176 |
| Salt Loom | 5 | 4 | 4.069 |
| Salt Kiln | 6 | 5 | 4.043 |
| Open Beacon | 26 | 19 | not stated |
| Paper Anchor | 21 | 28 | not stated |
Across the 40 ranked projects, 33 change position after adjustment. The top two projects swap places, and they are separated by only 0.021 points after adjustment (4.316 against 4.295). A small change in the model or the inputs could flip that order, which is one reason the article presents the correction as something to inspect rather than a final verdict.
What the 33-of-40 result does and does not show
The result shows that judge severity can change the order produced by a simple average, and that the correction produces the same result each time it is run on this fixture. It does not show that the adjusted order is correct. The figures come from the project author’s own reference data and have not been validated externally.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Where the access boundary sits
The project’s central rule is that every access check happens in the backend before a protected record is read or changed. Hiding a button in the interface is not treated as a security control.
A judge asking for another judge’s scores
The article uses this request as its main example. The server derives the caller’s identity from the session cookie and checks whether that judge is assigned to the project. It does not trust a user ID sent by the browser. A request for peer scores that fails this check receives a 403 response. A participant who calls the same route is also refused. Rankings and exports require organizer authorization.
How sessions and passwords are handled
- Session tokens are opaque, and only their SHA-256 digests are stored in SQLite.
- Passwords are stored as salted PBKDF2-HMAC-SHA256 hashes.
- Session cookies are HttpOnly and SameSite=Strict. The Secure flag is optional and applies when the site runs behind HTTPS.
- Logging out or changing a password revokes the affected sessions.
- Write requests from a foreign Origin are rejected, and login attempts are throttled.
These are implementation details described by the author. They have not been independently tested.
Deadlines and publication locks
Deadline checks run inside database transactions, so a late write is rejected at the database level rather than only by the web layer. Scorecards keep the rubric version that was in force when they were written, along with the original scores. Results and tallies are locked until they are published.
Recommended Free Tools
Community voting and the identity problem
Voting controls include a ballot limit per event and per account, rejection of votes for one’s own project, rejection of duplicate project votes, concealed tallies before publication, and a configuration lock once voting opens.
Rank #4
The author states plainly that these controls do not solve Sybil identity. An account does not prove that one person controls it, email matching does not prove inbox ownership, and shared networks make IP-based limits unreliable. For high-stakes community prizes, the author recommends curated invitations instead of an open vote.
The anomaly queue: what it flags and what it cannot do
Why the first design was rejected
The first Isolation Forest design was dropped for several reasons. Its training contract used a different score scale. It depended on fields that were not available. Some of its peer and history features could leak information about the answer. Its evaluation split was unsuitable, and its dependencies could not be installed in the offline container image. The shipped version exports the trees to JSON and runs inference with the Python standard library.
Synthetic evaluation
The reported model setup uses 120 simulated events, 30 projects per event, four reviews per project and 14,400 reviews in total. About 4.6% of the reviews have injected anomalies. The Isolation Forest has 300 trees and a contamination setting of 0.05. The held-out test covers simulated events 108 to 119. All of these figures come from the project article’s synthetic setup.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches| Metric (synthetic held-out test) | Reported value | What it means here |
|---|---|---|
| Precision | 0.52 | About half of the reviews the model flagged were injected anomalies. |
| Recall | 0.56 | The model flagged about 56% of the injected anomalies. |
| F1 | 0.54 | Combines precision and recall; the article gives no further breakdown. |
| Overall accuracy | 0.95 | High mainly because anomalies are rare in the test data. |
| Decision-score gap | 0.137 | Reported as a separation figure; the article gives no further breakdown. |
Accuracy looks strong here because most reviews are normal. The article warns that the model still struggles with the rare class, and the precision and recall figures show that clearly. Most flags on the synthetic test are not injected anomalies, so an organizer should treat each flag as a question rather than a finding.
Best Value
False-alarm rates by simulated judge type
| Simulated judge type | Reported false-alarm rate |
|---|---|
| Normal | 0.8% |
| Inconsistent | 2.9% |
| Strict | 5.2% |
| Generous | 7.5% |
Strict and generous judges are flagged far more often than normal ones. The model is therefore sensitive to scoring style as well as to bad behavior, which means a legitimately harsh or lenient panel can generate alerts.
Signals on the official fixture
The official fixture produces 15 advisory signals. The fixture has no anomaly labels, so those signals show what the model flags but cannot show how accurate it is.
What the queue is not allowed to do
- Write, change or delete any score.
- Change normalization or the ranking.
- Assign judges or disqualify participants.
- Choose winners or issue certificates.
- Show peer scores to judges.
The queue is visible only to organizers. It works as a review aid, not as an automated fraud decision.
Running it locally
- Clone the repository:
git clone https://github.com/BeyondBug/DogFood.git - Move into the cloned directory and start the stack:
docker compose up - Before entering real event data, load the bundled fixture data and compare the adjusted ranking with the figures above. This is the quickest way to confirm that your copy behaves as the article describes.
The stack uses FastAPI and SQLite. Templates, fonts and scripts are stored locally, and Python packages are pinned to specific wheels, so the application can run offline once the image is built.
The supported deployment model
The project supports one Uvicorn worker with one SQLite database. Running several application instances against the same database is outside the documented model. The author ran warm local read probes, but these were short tests. They are not a production service-level objective, not a measure of how many users can be served at once, and they do not measure write contention. Event size and the number of simultaneous score submissions should be estimated before deployment.
Backups and known gaps
Backups are local SQLite snapshots, and the project includes integrity-check and restore procedures for them. The article lists the following limitations.
- There is no off-host disaster recovery. Copies of the snapshots need to be kept on another machine by the operator.
- Account recovery is not implemented.
- Email delivery is not implemented.
- Certificates can be verified publicly against the local database, but they are not cryptographically signed.
- Duplicate project detection matches only identical, non-empty repository URLs.
- Correcting a published score requires a versioned republication workflow that the article describes as future work.
The author’s stated aim
The author describes the goal this way: “The objective was software another organizer could evaluate, operate and extend, not a checklist with hidden gaps.” That goal explains why the article lists its limits alongside its features.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
