Competition rules and code of conduct

1. Eligibility

Anyone may participate in the competition in a team of 3–4. Student status is not required. Players under 18 may participate with a declaration signed by a parent or legal representative and submitted on-site. A captain under 18 may register the team with the consent of their parent or guardian, so a team made up entirely of players under 18 may also compete.

2. Registration and selection

The registration deadline is 8 November 2026 (Sunday), 23:59 CET. Registration requires a team name and the nickname and email address of every player (3–4 people).

Up to 20 teams may participate. Applications are assessed in order of arrival. Applicants beyond the first 20 teams are placed on a waiting list. We notify the captain by email about participation before the competition.

The team composition may be changed after registration, no later than 15 November 2026, by emailing [email protected]. Each team may have 3–4 people competing on-site.

3. Equipment and network

Every team member brings their own laptop and charger. The organiser provides the competition network on-site.

The challenge descriptions are in English; on-site communication is in Hungarian.

The organiser provides lunch on the day of the competition; you can report food intolerances or special dietary requirements by email after your registration has been confirmed. Teams may freely use the software they need for the competition on their own devices, except for the activities listed under “Prohibited activities” in these rules.

4. Scope and period

During the Attack-Defense phase of the competition, only competition services assigned to other teams and running within the competition network range designated by the organiser may be attacked, between 10:00 and 17:30.

As the operator of the systems, the organiser expressly authorises activities against the competition services carried out within the limits of these rules.

5. Prohibited activities

All offensive activity outside the scope defined in the preceding section is prohibited, including in particular:

• attacking the scoring and infrastructure systems (scoreboard, competition infrastructure)
• attacking the on-site wired and Wi-Fi networks
• attacking other teams’ own devices and workstations
• denial-of-service (DoS/DDoS) attacks or brute-force attacks that put a load on the competition network
• sharing flags between teams
• publicly disclosing a vulnerability discovered during the competition or using it outside the competition without the organiser’s prior written permission
• deceiving organisers, volunteers or other participants through social engineering
• physically dismantling or modifying on-site devices or network equipment

6. Scoring

A fixed number of points is awarded for submitting the correct flag for each Jeopardy challenge.

In the Attack-Defense phase, attack points are awarded for flags obtained from opponents, and defence and availability points for keeping your own services running.

In a tie, the earlier submission determines the ranking.

We explain the detailed point values and submission method at the opening technical briefing. These will also be available on the competition platform.

7. Prizes

Prizes with a total value of HUF 900,000 are awarded as non-cash prizes.

• 1st place – non-cash prizes worth HUF 400,000 per team
• 2nd place – non-cash prizes worth HUF 300,000 per team
• 3rd place – non-cash prizes worth HUF 200,000 per team
• the prize cannot be exchanged for cash or transferred to anyone else, and the team itself decides how to divide its prize among its members
• the organiser reserves the right to change the composition and value of the prizes and the date of the competition

8. Disqualification and complaints

A breach of the rules, including any act listed under “Prohibited activities”, results in immediate disqualification and loss of eligibility for a prize. If a criminal offence is suspected, the organiser may report it to the authorities.

The organiser decides on disqualification and other matters concerning the competition. A complaint against the organiser’s decision may be submitted in writing to [email protected] within 3 days of its communication. The head of the organising team assesses the complaint within 5 working days.

9. Changes and cancellation

In a force majeure situation (such as a natural disaster, action by the authorities or the venue becoming unavailable), the organiser is entitled to change the date of the competition or cancel it.

If the competition is cancelled, the organiser deletes the registration data and notifies every team captain by email.

10. Liability and safety

Each participant is responsible for their own equipment. The organiser is not liable for damage to participants’ equipment at the event, except for damage caused intentionally or damage to human life, physical integrity or health, for which the organiser does not exclude or limit liability.

The house rules of the venue, Kandó Kálmán Kollégium, also apply during the event. Breaching them may also result in disqualification from the competition.

Players under 18 may participate only with a declaration signed by a parent or legal representative and submitted on-site. Without a signed declaration, the player may not compete.

11. Photo and video

The organiser takes photos and videos at the event and uses them to present the competition and on HoneyLab’s and the University’s communication channels. If you do not wish to appear in recordings, let us know at on-site registration. Identifiable recordings of players under 18 are used only on the basis of a declaration by their legal representative. See the Photo and video section of the privacy notice for details.

12. Data processing

The privacy notice provides detailed information about the data processed during registration and the competition: cyberquest.honeylab.hu/en/privacy.

13. Contact

You can contact the organisers with your questions at [email protected].