Issues

SSRF via `submissionApiUrl` config field — attacker receives M2M bearer token on scoring callbacks

Rejected - Not reproduced

#50

· FedorPortnoi opened

on May 28, 2026

Leaderboard isn't sorted

Accepted

#49

· eulerscheZahl opened

on May 28, 2026

`normalizeTestPhase(undefined)` silently defaults to `'provisional'` — EXAMPLE and SYSTEM score rows with missing metadata incorrectly counted as provisional

Rejected - Not a bug

#48

· FedorPortnoi opened

on May 28, 2026

`rerunLatestSubmissions()` always dispatches PROVISIONAL scoring regardless of the currently open phase

Accepted

#47

· FedorPortnoi opened

on May 28, 2026

MINIMIZE scoring: error/default score of `0` treated as the best possible score, collapsing all valid scores to zero relative credit

Accepted

#46

· FedorPortnoi opened

on May 28, 2026

Per-test-case timeout uses `process.destroy()` (SIGTERM) — submission process can catch the signal and run beyond the time limit

Accepted

#45

· FedorPortnoi opened

on May 28, 2026

No deduplication on Kafka consumer — duplicate message delivery launches two ECS scorer tasks for the same submission

Rejected - Not a bug

#44

· FedorPortnoi opened

on May 28, 2026

`updateSubmissionStatus()` is a no-op mock — submission processing status never updated in Submission API

Rejected - Not a bug

#43

· FedorPortnoi opened

on May 28, 2026

ScorerMain unconditionally dumps all environment variables to stdout — ACCESS_TOKEN and seeds exposed in every run

Rejected - Duplicate

#42

· FedorPortnoi opened

on May 28, 2026

Seccomp filter only blocks socket() — ptrace, process_vm_readv, perf_event_open not blocked; user code can read tester JVM memory

Rejected - Duplicate

#41

· FedorPortnoi opened

on May 28, 2026

`RUNNER_ISOLATED_EXECUTION=1` env var set by isolation wrapper allows submissions to detect the judging environment

Rejected - Not a bug

#40

· FedorPortnoi opened

on May 28, 2026

Auto-generated `.csproj` for C# submissions includes `<AllowUnsafeBlocks>true</AllowUnsafeBlocks>`

Rejected - Duplicate

#39

· FedorPortnoi opened

on May 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

SSRF via `submissionApiUrl` config field — attacker receives M2M bearer token on scoring callbacks

Leaderboard isn't sorted

`normalizeTestPhase(undefined)` silently defaults to `'provisional'` — EXAMPLE and SYSTEM score rows with missing metadata incorrectly counted as provisional

`rerunLatestSubmissions()` always dispatches PROVISIONAL scoring regardless of the currently open phase

MINIMIZE scoring: error/default score of `0` treated as the best possible score, collapsing all valid scores to zero relative credit

Per-test-case timeout uses `process.destroy()` (SIGTERM) — submission process can catch the signal and run beyond the time limit

No deduplication on Kafka consumer — duplicate message delivery launches two ECS scorer tasks for the same submission

`updateSubmissionStatus()` is a no-op mock — submission processing status never updated in Submission API

ScorerMain unconditionally dumps all environment variables to stdout — ACCESS_TOKEN and seeds exposed in every run

Seccomp filter only blocks socket() — ptrace, process_vm_readv, perf_event_open not blocked; user code can read tester JVM memory

`RUNNER_ISOLATED_EXECUTION=1` env var set by isolation wrapper allows submissions to detect the judging environment

Auto-generated `.csproj` for C# submissions includes `<AllowUnsafeBlocks>true</AllowUnsafeBlocks>`

Uh oh!

Search results