Internship opportunity
An internship offer after a short interview, or a gift voucher if you prefer. Plus a certificate.
BalanceIt Bug Hunters
Hunt bugs in a real product. Climb the live leaderboard. Win an internship.
Registration is free and needs a BalanceIt account. If you do not have one yet, you create it on the way.
- Hunters registered
- –
- Teams
- –
- Colleges
- –
Timeline
-
Registration
20 Nov – 6 Dec 2026
Create your BalanceIt account, then register solo or as a team of up to 3.
-
Kickoff
Mon 7 Dec 2026
One-hour online kickoff: rules, scope, how to report, live Q&A.
-
Hunt
7 – 20 Dec 2026
Fourteen days, two weekends. Reports are judged within about 48 hours.
-
Final judging
21 – 27 Dec 2026
Remaining reports are judged, disputes are heard, the leaderboard is frozen.
-
Results
Wed 30 Dec 2026
Winners announced live. Certificates follow.
Prizes
The top 3 on the final leaderboard win. Every hunter with at least one valid finding gets a participation certificate.
Gift voucher
A gift voucher and a certificate.
Gift voucher
A gift voucher and a certificate.
How it works
Create your account
Sign up free at BalanceIt (or sign in). Every hunter must be a BalanceIt user.
Register for the event
Choose solo, start a team, or join a team with the invite code your captain shares. Teams have up to 3 people from the same college.
Hunt from 7 December
Use BalanceIt like a real user, on the web and mobile apps, and look for anything that breaks: security holes, wrong data, crashes, confusing screens.
Report and climb
Send each finding through the app with clear steps. Judges score it, and the live leaderboard updates.
Scoring
Every valid observation earns points. Security earns the most.
| Category | Critical | High | Medium | Low |
|---|---|---|---|---|
| Security | 100 | 50 | 20 | 5 |
| Functional and logic bugs | – | 20 | 10 | 4 |
| Performance, data and accessibility | – | 12 | 6 | 3 |
| UI/UX, copy and suggestions | – | – | 4 | 2 |
- Points count only after a judge marks a report valid, never when it is submitted.
- First valid report wins. A duplicate earns 1 point if it arrived within 24 hours of the original, otherwise nothing.
- Clear reproduction steps plus a proof of concept or a suggested fix earn a 20% quality bonus.
- At most 10 low-severity findings count per hunter or team.
- Invalid reports and copied scanner output cost 5 points each. Breaking the rules means disqualification.
- Ties go to whoever reached the score first.
Live leaderboard
The leaderboard goes live when the hunt opens on 7 December. It shows team names or aliases, colleges and points, never finding details.
Rules and safe harbour
Version 2026-11-10. You accept these when you register.
In scope
- balanceit.life and app.balanceit.life (the web app), and the BalanceIt iOS and Android apps.
- The BalanceIt API that these apps call, used through your own accounts.
- Any kind of problem: security, functional, data, performance, accessibility, UI/UX and copy.
Out of scope
- Denial of service, load testing, flooding or anything that slows the service down for others.
- Automated scanners or scripts above 1 request per second, or any brute-forcing.
- Phishing, social engineering or contacting BalanceIt staff or users to test something.
- Physical attacks, and attacks on our providers (Google, Apple, AWS, payment and email providers).
- Payment and checkout pages: report what you see, never attack them or use real cards.
- Reports that are only scanner output, missing headers or version banners with no demonstrated impact.
How to test
- Use only accounts you created yourself, plus your teammates’ accounts with their agreement.
- If you ever see someone else’s data, stop at once, do not copy or keep it, and report it straight away.
- Never change, delete or download data that is not yours, and never keep access you were not meant to have.
- Do not share a finding with anyone outside your team until BalanceIt has fixed it and said you may.
- One registration per person. Every team member must have their own BalanceIt account.
Who can take part
- Students currently enrolled at one of the participating colleges, aged 18 or over.
- Solo, or a team of up to 3 students from the same college. You can be in one team only.
- BalanceIt employees, contractors and their families cannot take part.
Safe harbour
If you follow these rules in good faith, BalanceIt will treat your testing as authorised, will not take legal action against you for it, and will not ask anyone else to. If you are unsure whether something is allowed, ask the organisers first.
Your data
We use your registration details only to run the event: to contact you, judge reports, show the leaderboard and send certificates. The public leaderboard shows your team name or an automatic alias, your college and your points, never your email or phone number.
Questions
Do I need a BalanceIt account?
Yes. Every hunter must be a BalanceIt user, and you register and report from inside the app. The free Basic plan is enough.
Can we enter as a team?
Yes, up to 3 people from the same college. One person starts the team and shares the invite code; the others join with it. You can also hunt solo.
What counts as a bug?
Anything that is wrong: a security hole, a crash, wrong numbers, data that does not save, a broken screen on mobile, confusing copy. Security findings score the most.
Where do I report?
In the app, once the hunt opens on 7 December. Please do not post findings publicly or email them to staff.
How are winners chosen?
By points on the final, frozen leaderboard. The 1st place internship also includes a short interview; vouchers and certificates go to the top 3.
Is it really allowed to test the live site?
Yes, within the rules on this page. Stay on your own accounts, never slow the service down, and stop and report if you see anyone else’s data.