Welcome — VERDICT is a SANS FIND EVIL! 2026 hackathon entry

[TimothyVang]

VERDICT is a mode-aware verifier-gateway for forensic LLM agents — built for the SANS FIND EVIL! 2026 hackathon. Two AI models cross-check each other against forensic evidence, encoding SANS investigative discipline as schema rules (not prompts), producing a tamper-evident HMAC-signed audit trail.

Timeline

• Hackathon page: https://findevil.devpost.com/
• Submission deadline: Jun 15 2026 11:45 PM EDT (team-internal target Jun 14 EOD).
• Judging window: Jun 19 – Jul 3 2026; winners ~Jul 8 2026.
• Sponsor / judge: SANS Institute; Rob T. Lee (CAIO).

Where to read what

Document	Role
README.md	Entry point — what VERDICT does, three modes, agent loop
docs/ARCHITECTURE.md	Current authoritative architecture
docs/BUILD_PLAN.md	6-week TDD plan with task IDs (W#.#.#)
docs/DEVPOST_COMPLIANCE.md	Submission rule-to-artifact mapping
CLAUDE.md	Hard rules an agent must obey
CONTRIBUTING.md	Onboarding (PAT, GPG, clone, smoke test)
SECURITY.md	Vulnerability reporting

How to use this Discussions board

• 📣 Announcements — Maintainer updates: deadline shifts, schema freezes, demo-cut milestones.
• 💬 General — Anything that does not fit the other categories.
• 💡 Ideas — Propose features. v2 work parks here. v1 changes that touch the §3 hard rules of CLAUDE.md need an issue with rationale instead.
• 🙏 Q&A — Setup help, SIFT VM issues, Microsandbox / SGLang bring-up, env-var confusion. Read CONTRIBUTING.md first.
• 🙌 Show and tell — Hero-beat captures, accuracy-report deltas, demo cuts, eval results.
• 🗳️ Polls — Reserved for ambiguous tradeoffs (rare; most decisions live in docs/spec/ history).

What does not belong here

• Bug reports → open a GitHub Issue with the relevant W#.#.# task ID if applicable.
• Security vulnerabilities → follow SECURITY.md (do not post privately exploitable details here).
• Pull-request reviews → use the PR thread, not Discussions.

License: MIT. Hackathon allows MIT or Apache-2.0.