Two clear tiers emerged. The top four are genuinely working builds with real integrations (not mocked) and real security hygiene. The bottom four each carry a specific technical problem, noted in their cards below.
1. DEMOLAB · fanlab
DEMOLAB · Costa Rica · theme: Pensamiento Crítico
Func9
Eng9
Sec8
Composite8.7
A Flask + vanilla JS "civic reasoning" simulation game. An LLM generates scenarios, validates the quality of a player's justifications, and scores reasoning against an 8-criterion rubric, feeding an XP / achievement / level system and a final "Civic Mirror" summary.
Functionality: Real, not stubbed. Genuine Anthropic API calls per game phase, with retry and model-fallback logic. XP math is deterministic server-side and ignores any score the model proposes; archetype evidence quotes are verified against the player's own saved text.
Engineering: Well above hackathon norm. Encrypted stateless session recovery (Fernet with domain-separated keys), per-mission threading locks, session TTL and caps, specific API exception handling, and a real automated test suite (~30 Python tests plus a client-side DOM test), all using mocked AI so they run without credits.
Security: No committed secrets. Startup-validated signing secret, HttpOnly / SameSite / Secure cookies, request size caps. Self-disclosed gaps (no user auth, no per-IP rate limiting) are honest and real for an open deployment.
- Only one git author despite being a team submission.
- First commit is already a near-complete app rather than an incremental start.
Verify live: confirm the team built this during the event vs. prepared or AI-scaffolded it beforehand (git history alone cannot settle this).
Bottom line: The strongest code in the cohort. Real LLM integration, careful state engineering, and an actual test suite. The only discount is build provenance.
2. FIME · Osisnt (Team RUAJ)
Universidad de Colima (FIME) · Mexico · theme: Privacidad de los datos
Func8
Eng8
Sec8
Composite8.0
A native mobile OSINT / privacy app (Flutter) plus a FastAPI backend that runs real OSINT tools (Blackbird, Maigret, Holehe, Ignorant), WebAuthn / FIDO2 passkey auth, and an LLM "GuardAI" assistant grounded on scan results. Spread across three repositories (app, server, documentation) and deployed live behind Cloudflare Tunnel.
Functionality: Real end to end. The app calls the live backend for scans, passkeys, and assistant chat; the server shells out to genuine OSINT tools with per-tool timeouts and output caps; GuardAI is a real streaming LLM client grounded in report data.
Engineering: Clean domain-driven layering, ~32 backend and ~64 Flutter test files, an 80% coverage gate in CI, linting, database migrations, and a hardened production container (non-root, dropped capabilities, isolated networks).
Security: No committed secrets. Real passkey auth (user verification required, origin allowlisting), OSINT inputs guarded by regex allowlists before reaching a subprocess (command-injection defense), and production config that fails closed on dangerous defaults.
- Production backend URL hardcoded into the Flutter client (not a secret, but not externalized).
- A no-credential "testing" login path exists, gated behind an env flag.
Verify live: confirm the /auth/testing/session no-credential path is disabled on the deployed demo.
Bottom line: The most ambitious build in the cohort, and the rare case where a three-repo scope is fully backed by working code rather than shells. Unusually mature for a three-day event.
2. Mixed Team #2 · ACU (Tlacuachip)
UNITEC / multi-school · Mexico · theme: Emprendimiento
Func8
Eng8
Sec8
Composite8.0
A microentrepreneur formalization and location-intelligence platform. A React frontend, an Express API that queries live OpenStreetMap / Overpass data for business density plus an LLM for market reasoning, and two Postgres-backed microservices for auth and a provider catalog.
Functionality: Real. Density and report endpoints hit the live Overpass API for actual points-of-interest counts (with a committed offline pilot dataset as fallback); AI routes call a real provider and fall back to deterministic heuristics, honestly labeling which mode produced each answer.
Engineering: Above norm. CORS allowlist, body-size limits, per-IP rate limiting on AI routes, input minimization before data reaches the LLM, centralized error handling, real unit tests, and a multi-service deploy topology.
Security: No committed secrets. bcrypt + JWT auth, deliberate IDOR defense (user identity derived from the verified token, not client input), and prompt-injection-aware output filtering. Minor: a weak default JWT secret in the dev compose file.
- Only one committer visible for a "mixed team."
- Both Postgres microservices were wired to a real database only in the final hours.
Verify live: confirm the multi-service demo actually runs; the last-hour database wiring is the stability risk, not the code quality.
Bottom line: A genuinely built product with real external-data integration, honest AI fallbacks, and unusually mature security and privacy hygiene for a hackathon.
2. UL #3 (Abstract) · FiscalFEE / "Peak"
Universidad de la Libertad · Mexico · submitted theme: Desarrollo personal
Func8
Eng8
Sec8
Composite8.0
A fiscal assistant for Mexican freelancers: an AI advisor with tool-calling for tax-regime evaluation, CFDI 4.0 invoicing, and SAT lookups, plus a password-protected admin panel. The team name is "Abstract"; the shipped product is FiscalFEE.
Functionality: Real. Genuine CFDI 4.0 XML generation, PDF rendering, and a PAC (invoicing authority) adapter that calls the real sandbox API, with an honest labeled mock fallback when credentials are absent. SAT lookups and QR reading are real.
Engineering: Genuinely strong. Clean module separation, 27 test files exercising real edge cases (including IDOR and malformed IDs), typed validation, and 13 numbered architecture docs. Commit history shows real iteration, not churn.
Security: No committed secrets; .gitignore explicitly excludes certificate and key files, tied to the project's privacy thesis. Admin auth uses HMAC-signed cookies and constant-time comparison. A real same-day IDOR vulnerability was found and closed with regression tests.
- Theme mismatch: submitted under "Desarrollo personal" but the code is a tax and invoicing tool. A category-fit question for the panel, separate from technical merit.
- Heavily Claude co-authored (openly disclosed via commit co-authorship); iteration looks real and human-directed.
- The PAC integration was only tested against simulated responses, not a live transaction.
Verify live: probe whether team members can explain the CFDI and IDOR logic themselves, given the AI co-authorship.
Bottom line: The most substantively engineered repo in the batch, with a legitimate same-day security fix. Theme fit and end-to-end invoicing reliability are the open questions.
5. Mixed Team #1 · MafIA (Duplie)
Tec de Monterrey / multi-school · theme: Emprendimiento
Func7
Eng6
Sec7
Composite6.7
A TypeScript / Express "skill marketplace" MVP where users rent AI expert personas, chat with them via streaming, and generate downloadable deliverables. Publishing a new skill is gated by a similarity check. Blockchain and payment elements are explicitly simulated.
Functionality: Real, not scaffolding. Genuine multi-provider streaming chat (Anthropic to OpenAI to Gemini fallback), a real embeddings-based plagiarism gate, and working PDF / XLSX / DOCX generation.
Engineering: Serviceable but rough. Parameterized SQL throughout and an honest README, but no tests, no linting, and a heavily minified single-line frontend consistent with un-reviewed AI-generated bulk.
Security: No committed secrets, .env gitignored, all SQL parameterized. No auth (a single hardcoded demo user), which is acceptable for a demo.
- Single author, one dense dump commit; no incremental history to confirm when work happened.
- No automated tests.
Bottom line: A real, working MVP with genuine (if demo-scoped) AI integration. Rough engineering and a thin, late commit history hold it below the top tier.
6. Mixed Team #3 · Nopal-IA (Enfoca)
UAA / multi-school · theme: Rotación laboral
Func5
Eng6
Sec7
Composite6.0
A career-orientation product across two repositories. A genuinely well-built AI backend exists (Supabase Edge Function with real OpenAI tool-calling), but the frontend that actually ships never calls it.
Functionality: Split personality. The real AI path (validated tool-calling, multi-phase prompt) is solid, but the component the app actually mounts drives a scripted three-question funnel with regex keyword matching and a hardcoded job-match table. The component that calls the real AI is present but orphaned.
Engineering: The backend is disciplined (row-level security, a daily spend cap, per-call audit logging, a security-hardening migration). Weaknesses: the entire backend is duplicated across both repos, there are no tests, and the working backend and shipped frontend were never integrated. A default fallback model name is invalid.
Security: No committed secrets; auth and row-level security enforced on the main chat function. One newer endpoint runs with JWT verification off. Server-side tool-argument validation limits prompt-injection impact.
- The demoed UI does not call the real AI backend at all; the real integration is dead code in the shipped app.
- Backend logic duplicated (not shared) across two repos.
Verify live: grade the demo as seen (a scripted experience). Give partial credit for backend depth only if the team can show it working live via the test component or a direct call.
Bottom line: Real engineering competence behind the scenes, undercut by the fact that the actual demo is a scripted fake with the AI wired to nothing. Consistent with running out of integration time.
7. UFM · Free Minds (MiChamba)
Universidad Francisco Marroquín · Guatemala · theme: Comercio Informal
Func7
Eng4
Sec6
Composite5.7
A client-only React single-page app for informal-economy vendors: savings goals, contribution tracking, a gamified financial level, milestone rewards, and a rule-based FAQ assistant. All state lives in the browser; there is no backend or database.
Live demo: a temporary Cloudflare Tunnel URL was submitted (likely offline after the event).
Functionality: A real, working prototype with roughly 35 components, not an empty scaffold. The "AI assistant," however, is keyword matching against a static FAQ plus templated text, not a real model.
Engineering: Thin. The entire app is one 4,000-line file, with no component splitting, no routing library, no tests, and the default unedited framework README.
Security: No committed secrets, but the "auth" stores user passwords in plaintext in browser storage. Acceptable only as a disclosed prototype limitation.
- Single dump commit on the final day; no incremental history.
- A code comment states the core engine was "adapted from a prior project phase" (MiChamba Fase 5), so it builds on pre-existing work.
- The "AI" branding is misleading; it is static FAQ matching.
Bottom line: Solid product thinking and a functional frontend, but thin engineering rigor and a questionable build-during-hackathon scope given the reused engine.
8. UL #2 · KALIX
Universidad de la Libertad · Mexico · theme: Desarrollo personal
Func3
Eng5
Sec8
Composite5.3
A polished single-page React front-end pitching "marketplace infrastructure" that turns informal micro-businesses ("changarros") into scored, transferable assets. In reality it is a client-only demo built and exported from Lovable (a no-code AI app builder): a hardcoded catalog of 17 fictional businesses, a fixed scoring formula, a rule-based matcher, and a decorative "blockchain seal."
Functionality: Renders and "works" as a demo, but the entire value proposition is fabricated. The score is a hand-tuned weighted-sum formula, the matcher compares against 3 hardcoded buyer profiles, and credit approval is an explicitly simulated calculation. There is no backend, no database, no real AI or LLM anywhere, and no real chain: the "Polygon" seal is just a browser-side SHA-256 hash (its own UI labels it "prototype registry").
Engineering: Clean, idiomatic React/TypeScript with a sensible component layout, but this is standard Lovable output, not hand-engineering: 40+ files are boilerplate UI components, there are zero tests, and there is no real data layer to build against.
Security: No secrets committed (the export even ships a secret-scanning script). No real auth, payments, or backend, so there is effectively nothing to attack. Fake bank details are clearly labeled as simulated.
- Repository is a same-day single-commit export from a no-code tool (Lovable), with no iterative version history; the README opens "This project was built with Lovable."
- The "blockchain / Polygon" claim is marketing over a plain client-side hash, with no on-chain interaction.
- No backend or persistence despite the "marketplace infrastructure" pitch; everything is static arrays plus browser storage.
Bottom line: A well-designed, working UX prototype, but the technical claims (real scoring, matching, valuation, blockchain) are entirely simulated, and the code itself was AI-generated by a no-code builder rather than written by the team. Judge this as a design prototype, not a functioning technical product.
These two teams have no source-code repository to review: one submitted a no-code (Lovable) application with a blank GitHub field, and one has no submission on record. They may still be strong on the product, marketing, and mission axes; they simply cannot be assessed on source-code functionality, engineering, and security. Flagged for the organizers to confirm.