Sunday, October 18, 2026
Omnikon Bug Hunt 2026 is an online web security and bug discovery competition hosted by Omnikon and powered by Unstop. Participants are given access to an intentionally vulnerable website - created and explicitly authorized by Omnikon - and are challenged to find, document, and report reproducible bugs and security vulnerabilities within that controlled environment.
Who it's for The challenge is aimed at students, aspiring developers, and cybersecurity enthusiasts who want to sharpen their debugging, analytical thinking, and responsible security testing skills. Participation is individual (team size of one).
How it works
Eligible findings Participants may report reproducible functional bugs, validation failures, logic errors, UI issues, and security vulnerabilities found within the explicitly authorized challenge environment. Reports are evaluated on validity, reproducibility, severity, impact, and the quality of supporting evidence. Duplicate reports are handled according to the published submission rules.
Rules and responsible testing
Prizes and recognition Confirmed prizes, ranking criteria, tie-breakers, and result announcement dates are published on the official event page before the competition begins. The Rank 1 winner is awarded a .xyz domain. Omnikon's review team makes final eligibility and ranking decisions according to the published rules.
Format and logistics The competition is fully online, free to enter, and runs from 18 October to 5 November 2026, with the registration deadline on 5 November 2026. It is a practical, hands-on opportunity for early-career security talent to build a portfolio of validated findings and demonstrate responsible disclosure practices.