AI Enterprise SolutionsGPT & Claude

HackTrain

Our initial users are beginner cybersecurity students in instructor-led courses and their teachers at training centers. During practical web-security labs, students often struggle to interpret an error, understand why an attempt failed, or choose their next step. They may follow a walkthrough and complete the task without understanding how to solve a similar problem independently. Teachers then need to review explanations and ask follow-up questions individually to identify each student’s difficulty. A completed task alone does not reveal how much help the student needed or what they actually understood. The problem is helping students progress while giving teachers clear evidence of which skills students can apply independently and where they need further practice.

Open the demo Video GitHub

Preliminary score

58.5/ 100Promisingaverage of 2 judges

Value for the user18.0 / 25
A specific problem and a clear outcome from solving it.
Prototype and use of AI14.5 / 30
A working core scenario, and what AI actually contributes to the result.
Quality testing10.0 / 20
Tests, examples of failures, and comparison with the current approach.
Feasibility10.5 / 15
Data requirements, running costs and a clear next step.
Originality5.5 / 10
A meaningful difference from common solutions.

What the judges wrote

Claude Opus 5.5Preliminary55/100
Strengths
Your problem framing is sharp: separating 'completed' from 'understood' gives teachers and training centers something they cannot see today, and you name specific users (beginner web-security students, instructors with 15–25 students). Your backend is engineered seriously, with server-side JSON Schema validation of AI output, Redis rate limits, a circuit breaker and a fallback hint that is explicitly labelled as non-AI. Your README is unusually candid about what is and isn't finished, and you report a real deployment failure (API calls returning the frontend page). Your unit economics (≈1.3 AZN cost per learner, AZN pricing, pilot timeline) make the business side concrete.
To improve
Your core differentiator is not built yet: the README says the lab runner, attempt evidence, assessment and reporting are incomplete, and only Level 1 hints exist. The demo therefore shows course management plus an LLM hint, not the 'Lab B proves you learned' loop from the deck. Your deck cites 60 AI eval runs across 20 cases, but the submission says live AI quality was not established and shows no results, so publish the per-case scores and failures. Your README also says the test suite was not re-run after the latest AI changes. Prioritise one end-to-end SQL-injection lab with server-verified success and an unassisted follow-up task, then measure fixed hints against AI hints on time-to-first-useful-action.
GPT-6 AstraPreliminary62/100
Strengths
Your team identifies a concrete teaching problem: completing a cybersecurity lab does not demonstrate independent competence. Your documented course-to-task tutoring flow gives AI relevant learning objectives and student explanations rather than offering a generic chatbot. Your explicit fallback labeling and specific authentication, access-control and deployment failure cases show useful engineering discipline.
To improve
Your pitch should distinguish the implemented Level 1 tutor from the unfinished lab runner, independent assessment and teacher evidence card. Re-run tests against the submitted version, since your README limits earlier results to an older code state, and substantiate the deck’s 60 AI evaluations with outputs and scored results. Compare live tutoring against fixed hints for correctness, answer leakage, teacher review time and success on an unassisted follow-up task. Validate your per-learner cost assumptions using measured hint usage and lab-hosting workloads during a small training-center pilot.

The team

Əli Ağazadə
product
Ramin AbdullayevLead
developer
Elgun Garayev
developer
Mustafa Qasımov
developer

Disclosure

Required by the rules. Judges verify it against the repository.

Models: openai/gpt-oss-20b via the Groq API for AI tutoring. ChatGPT and OpenAI Codex were used for development assistance.
Data: Course and task content, learning objectives, synthetic demo examples, and learner-submitted explanations used as context for AI hints. No custom model training was performed.
Components: Pre-existing HackTrain project code; React, TypeScript, Vite, Tailwind CSS, shadcn/ui, Java 21, Spring Boot, Spring Security, PostgreSQL, Flyway, Redis, Bucket4j, Docker Compose, and the Groq API. Netlify is used for frontend hosting.
Built during the event: Confirmed

Quality testing

We tested HackTrain’s reviewed MVP build across the frontend, backend and API workflows: • 10/10 frontend tests passed, alongside TypeScript validation and a production build. • 32/32 backend unit tests passed, and the backend package built successfully. • 38/38 automated HTTP checks passed, covering authentication, organizations, groups, course publishing, assignments, access restrictions, rate limiting and AI fallback behavior. We deliberately tested failure scenarios, including incorrect passwords, reused refresh tokens, incomplete course publication, unauthorized invitation acceptance and oversized requests. The tested safeguards rejected these actions with the expected responses. A deployment check exposed a frontend–backend routing mismatch: some API requests returned the frontend page instead of JSON. This demonstrated that a successful frontend build alone does not establish a working deployment; API connectivity requires separate verification. We also tested AI-provider unavailability. The system returned a predefined hint explicitly labelled as fallback content, preserving access to guidance while distinguishing it from an AI-generated response. Our comparison baseline is learning with fixed hints and walkthroughs. Fixed hints provide predefined guidance, while HackTrain includes the task’s learning objective and the learner’s explanation in the tutoring request. The intended benefit is guidance that addresses the learner’s specific difficulty without immediately revealing the solution. These results establish application behavior within the tested environment. Local database checks used PGlite rather than the full production PostgreSQL/Docker setup. Live AI quality and learning improvements were not established by these tests. Our next evaluation will compare fixed hints with AI guidance using time to the first useful action and success on a new, unassisted task. AI responses will also be assessed for technical correctness, relevance and excessive disclosure of the solution.

Worth 20 of the 100 points.

Running it

Demo access: Open https://sage-starlight-889c7e.netlify.app/auth Email: [email protected] Password: 12345678 Use the preconfigured demo account; registration and email confirmation are not required. How to explore: 1. Sign in and open Organizations. 2. Select an organization and explore its groups and courses. 3. Open a published course and review its tasks and learning objectives. 4. Open the AI Assistant, select a task, describe your approach or difficulty, and request a hint. If no sample course is available, use the demo account to create an organization and a group. Create a course containing a topic, task, and learning objective, then publish it and assign it to the group. Local setup: Requires Git, Node.js/npm, and Docker with Docker Compose. 1. Clone https://github.com/elgngryv/Hacktrain 2. Configure backend/.env using backend/.env.example, including the database, Redis, JWT, and Groq settings. 3. From the backend directory, run: docker compose up -d --build 4. From the repository root, run: npm ci 5. Start the frontend with: npm run dev 6. Open http://localhost:8080/auth and use the demo credentials above. The backend runs on port 8081. Demo scope and limitations: The documented demo covers organization and course management and Level 1 AI guidance. It uses a shared administrator account. Live AI responses require a valid server-side Groq API key and provider availability. If AI is unavailable, the application displays an explicit fallback response.

Project ownership

The team keeps the rights to this project. Judges were given access for verification only.