API and webhooks
/api/v1/... keyed by X-API-Key with SHA-256 hashed storage, prefix display, expiry and revocation, plus interactive docs at /docs. Webhooks sign every payload with HMAC-SHA256 and retry 3 times with backoff in BackgroundTasks — never blocking the request.
Fired on submit and score events. A malicious organizer pointing hooks at internal hosts is an documented operator-trust boundary, not a bug we pretend away.
Proof people can keep
Certificates are Ed25519-signed and publicly checkable at /certificates/verify — participation, winner and judge-service types. The gallery widget (/api/events/{slug}/widget.js) embeds any event anywhere, and bulk JSON import/export tracks per-record errors as jobs.
Run it yourself
Every post maps to a real route or file in this repo. Start with the gallery, then the docs.
Keep reading
View allSep 20, 2026 · Products
Community voting without ballot stuffing
Email-gated tokens, deterministic per-token shuffles, hidden-until-published results and a vote_audit_log organizers can actually read.
Oct 3, 2026 · Engineering
Run the whole platform with one command: setup guide (main branch)
Clone main, docker compose up, seed fixtures, test accounts, and the 7/7 acceptance checker — everything to go from zero to judging in minutes.
Oct 3, 2026 · Company
Build the platform that will judge you: how we built DOGFOOD 2026
FastAPI + Next.js + Postgres with backend-enforced judge isolation, z-score calibration and one-command Docker — our Write-Up Quest build log.