Fair ballots
Votes start at POST /api/events/{id}/voting/token — 5 per hour per email. Ballot order is a deterministic per-token shuffle: fair ordering, stable reloads, no position bias.
Results stay hidden from the public until results_published_at; organizers always see them. Comments go through an organizer approve queue.
Abuse controls
One vote per person is a unique (event, project, voter_email) constraint, backed by per-IP rate limits and a duplicate-detection audit entry. Every issue, rejection and rate-limit lands in vote_audit_log with IP, email and user agent.
Honest limit, stated in THREAT-MODEL.md: email is cheap, so determined Sybils need organizers to actually read the audit log. We built the log view for exactly that.
Run it yourself
Every post maps to a real route or file in this repo. Start with the gallery, then the docs.
Keep reading
View allSep 15, 2026 · Products
Stretch without sprawl: API keys, webhooks and verifiable certificates
Hashed X-API-Key REST with OpenAPI docs, HMAC webhooks with backoff, Ed25519 certificates and an embeddable gallery widget.
Oct 3, 2026 · Engineering
Run the whole platform with one command: setup guide (main branch)
Clone main, docker compose up, seed fixtures, test accounts, and the 7/7 acceptance checker — everything to go from zero to judging in minutes.
Oct 3, 2026 · Company
Build the platform that will judge you: how we built DOGFOOD 2026
FastAPI + Next.js + Postgres with backend-enforced judge isolation, z-score calibration and one-command Docker — our Write-Up Quest build log.