Opportunity brief
About the Competition
Powered By Unstop
Think you have the eye to spot bugs that others miss?
Omnikon Bug Hunt 2026 is a web security and bug discovery competition where participants investigate an intentionally vulnerable website created and authorized by Omnikon. Identify reproducible bugs, document their impact, and compete to submit the most valuable valid findings.
This challenge is designed for students, aspiring developers, and cybersecurity enthusiasts who want to strengthen their debugging, analytical thinking, and responsible security testing skills.
Competition Format
- Mode: Online
- Participation: Individual
- Registration period: 18 October – 5 November 2026
What Participants Will Do
- Register for the competition.
- Receive the official challenge instructions and authorized testing URL.
- Investigate the designated website for eligible bugs.
- Submit reproducible reports through the official submission form.
- Wait for the Omnikon review team to validate findings and determine the final rankings.
Eligible Findings
Participants may report reproducible functional bugs, validation failures, logic errors, UI issues, and security vulnerabilities within the explicitly authorized challenge environment.
Reports will be evaluated based on validity, reproducibility, severity, impact, and the quality of the supporting evidence.
Duplicate reports will be handled according to the published submission rules.
Rules and Responsible Testing
- Test only the designated website and systems explicitly authorized by Omnikon.
- Do not attack third-party websites or infrastructure.
- Do not perform denial-of-service attacks, destructive testing, social engineering, or attempts to access real users' data.
- Do not modify, delete, or disrupt data or services.
- Submit clear reproduction steps and supporting evidence.
- Do not publicly disclose unpatched vulnerabilities before authorization from the organizer.
- Omnikon's review team will make final eligibility and ranking decisions according to the published rules.
Eligibility
Students, developers, and cybersecurity enthusiasts may participate, subject to the eligibility conditions published on the official registration page.
Prizes and Recognition
Confirmed prizes, ranking criteria, tie-breakers, and result announcement dates will be published on the official event page before the competition begins.