Official Rules

Sponsor: Veria Labs, Inc., 2261 Market St STE 85941, San Francisco, CA 94114 (“Sponsor”)

Effective Date: August 4, 2026

NO PURCHASE OR PAYMENT OF ANY KIND IS NECESSARY TO ENTER OR WIN. A PURCHASE OR PAYMENT WILL NOT INCREASE AN ENTRANT’S LIKELIHOOD OF WINNING. VOID WHERE PROHIBITED OR RESTRICTED BY LAW.

1. Binding Agreement

These Official Rules (the “Rules”) govern the Veria Labs Unhackable Challenge (the “Challenge”). By submitting an Entry, each entrant, on behalf of itself and the organization it represents (each, a “Participant”), agrees to be bound by these Rules and by the decisions rendered in accordance with Section 9. The Challenge is offered and administered solely by Sponsor.

2. Definitions

“Assessment” means a security assessment of a Confirmed Participant’s Application conducted by Sponsor pursuant to Section 8.

“Application” means the commercially operated software product or service identified in a Participant’s Entry.

“Assessment Slot” means an allocation entitling a Confirmed Participant to an Assessment pursuant to Section 6.

“Confirmed Participant” means a Participant whose eligibility has been confirmed pursuant to Section 5.3 and that has executed the agreements described in Section 5.4.

“Entry” means a complete submission made in accordance with Section 5.

“High-Severity Security Vulnerability” or “HSSV” means a finding in which the Application’s behavior deviates from its intended behavior in a manner that has security implications, including without limitation unauthorized data access, privilege escalation, authentication or authorization bypass, data exposure, injection, or a logic flaw compromising confidentiality, integrity, or availability, and that (a) receives a score of 7.0 or higher under the Common Vulnerability Scoring System version 4.0, or (b) receives an equivalent classification under another industry-standard framework expressly identified in the applicable Scope Agreement. A software error, crash, or defect without security implications is not an HSSV. A finding classified as informational, low, or medium severity is not an HSSV.

“Scope Agreement” means the written agreement described in Section 5.4 establishing the scope, methodology, and timeframe of an Assessment.

3. Challenge Period

3.1 Entry Period

Entries may be submitted beginning August 7, 2026 at 12 a.m. Pacific Time — after the close of the Black Hat USA 2026 exhibit hall and the conclusion of all onsite collection of expressions of interest — and ending August 9, 2026 at 11 p.m. Pacific Time (the “Entry Period”). No Entry may be submitted, and no Entry shall be accepted, prior to the opening of the Entry Period.

3.2 Assessment Period

All eligibility review, agreement execution, and Assessments shall occur during the period beginning August 10, 2026 and concluding no later than September 30, 2026 (the “Assessment Period”). No Assessment, agreement execution, eligibility determination, or prize-related activity shall occur at Black Hat USA 2026 or any other trade show or event.

4. Eligibility

4.1 To be eligible, a Participant and its Application must satisfy each of the following criteria at the time of Entry and continuously through the completion of the Assessment:

(a) The Participant organization employs more than fifty (50) employees;

(b) The Participant develops and commercially operates substantial proprietary software as a material component of its business, including without limitation Software-as-a-Service products, financial technology platforms and services, and other software-enabled products or services; provided that no organization whose core business consists of cybersecurity products, services, or consulting shall be eligible;

(c) The Application is a commercially operated product or service owned by the Participant organization; personal, hobby, and open-source projects not owned by the Participant are ineligible;

(d) If the Application is blockchain-based or incorporates smart contracts, it has not previously undergone a formal third-party security audit;

(e) The Participant is willing and legally authorized — including under applicable regulatory requirements and agreements with third parties — to grant Sponsor access to the complete source code of all repositories associated with the Application for the duration of the Assessment; partial or restricted access shall render the Entry ineligible;

(f) The individual submitting the Entry is authorized to bind the Participant organization to these Rules; and

(g) The Participant is organized and operating in a jurisdiction in which participation in the Challenge is lawful.

4.2 Employees, officers, and directors of Sponsor and its affiliates, contractors engaged by Sponsor in connection with the Challenge, and members of the immediate households of any of the foregoing are not eligible.

5. Entry

5.1 Sole Method of Entry

The sole method of entry is completion of the entry form at verialabs.com/challenge during the Entry Period. Entry is free. No purchase, payment, event registration, or event attendance is required to enter or win, and attendees of Black Hat USA 2026 or any other event shall receive no priority, advantage, or preferential treatment. Entry shall not be conditioned upon attendance at, or participation in, any product demonstration or sales presentation. All Entries shall be timestamped upon receipt and placed in a single queue in order of receipt. Limit one (1) Entry per organization; subsequent Entries from the same organization shall be void.

5.2 Onsite Expressions of Interest; Not Entries

At Black Hat USA 2026, Sponsor may collect contact information and nonbinding expressions of interest regarding the Challenge at its exhibit booth, through transparent means and with appropriate consent (such as voluntary badge scans or a promotional sign-up sheet). An expression of interest is not an Entry, does not constitute entry into the Challenge, confers no position in the Entry queue and no priority or advantage of any kind, does not initiate any eligibility review, and creates no obligation on either party. Individuals who provide an expression of interest may be sent the entry link after the opening of the Entry Period. Any consent to receive marketing communications shall be requested separately and affirmatively, in accordance with Sponsor’s Privacy Policy and applicable law. No aspect of the Challenge shall be conducted or administered at Black Hat USA 2026.

5.3 Eligibility Confirmation

Sponsor shall review Entries in order of receipt and shall confirm or decline eligibility within two (2) business days after the close of the Entry Period, applying solely the criteria set forth in Section 4 and the grounds set forth in Section 11.

5.4 Pre-Assessment Agreements

Prior to commencement of an Assessment, Sponsor and the applicable Participant shall execute a mutual non-disclosure agreement, a data protection agreement, and a Scope Agreement. If, despite the parties’ good-faith efforts, a Scope Agreement is not executed within ten (10) business days after eligibility confirmation, the applicable Assessment Slot shall pass to the next eligible Entry in the queue. Execution of the foregoing agreements is a condition of receiving an Assessment; it is not a condition of, or consideration for, Entry.

5.5 Entry Conditions

Entries that are incomplete, illegible, or submitted by unauthorized individuals are void. Sponsor’s electronic records of receipt shall be the official record of Entry time. Sponsor shall provide an electronic confirmation of receipt for each Entry.

6. Assessment Slots; Cap

6.1 Sponsor shall conduct Assessments for up to ten (10) Confirmed Participants. Assessment Slots shall be allocated in order of Entry receipt.

6.2 Sponsor shall assess every Confirmed Participant allocated an Assessment Slot, subject only to Section 11.

6.3 Eligible Entries exceeding the number of Assessment Slots shall be placed on a waitlist in order of receipt and offered any Assessment Slot that becomes available under Section 5.4 or Section 11.

6.4 Each Confirmed Participant’s eligibility for a Prize is independent. The outcome of one Participant’s Assessment shall have no effect on any other Participant’s eligibility or outcome.

7. Skill-Based Determination

The Challenge is a contest of skill. Each outcome is determined solely by whether the Participant’s Application, as evaluated against the objective criteria set forth in Section 2 (definition of HSSV) and the applicable Scope Agreement, contains a qualifying HSSV. No outcome is determined by random drawing, order of entry, or any element of chance.

8. The Assessment

8.1 Sponsor shall conduct each Assessment in good faith, using its automated security testing systems and/or qualified security personnel, within the scope, methodology, and timeframe set forth in the applicable Scope Agreement.

8.2 Sponsor shall apply substantially consistent methodology and level of effort across all Assessments.

9. Determination of Outcome; Independent Review

9.1 Initial Determination

Upon conclusion of each Assessment, Sponsor shall determine in good faith, applying the criteria set forth in Section 2, whether the Assessment identified at least one qualifying HSSV, and shall notify the Participant of the determination and make the findings available pursuant to Section 12.

9.2 Independent Review

If a Participant disputes Sponsor’s classification of a finding as a qualifying HSSV, or Sponsor’s withholding of a Prize under Section 11.2, the Participant may, within ten (10) business days after notification, submit the dispute to an independent third-party reviewer. The reviewer shall be an independent security assessment firm or credentialed security professional with demonstrated expertise in application security and CVSS scoring, mutually agreed by the parties within five (5) business days after the Participant’s request. If the parties fail to agree within that period, the reviewer shall be appointed, upon application by either party, by the American Arbitration Association in accordance with its procedures for the appointment of neutrals. The reviewer shall be compensated by Sponsor and shall have no ongoing business relationship with either party. The independent reviewer’s determination of whether the disputed finding satisfies the criteria set forth in Section 2, or whether the grounds in Section 11.2 are satisfied, shall be final and binding on both parties.

9.3 Declaration of Winner

A Confirmed Participant whose completed Assessment yields no qualifying HSSV, after expiration of the review period in Section 9.2 or completion of any independent review, shall be declared a winner (a “Winner”), subject to verification pursuant to Section 10.

10. Prizes

10.1 Prize

Each Winner shall receive, at the Winner’s election, one of the following (each, a “Prize”): (a) one (1) new 2026 Porsche 911 Carrera coupe, base specification (Approximate Retail Value: $129,950, inclusive of manufacturer delivery, processing, and handling charges), or (b) a cash payment of one hundred twenty-nine thousand nine hundred fifty U.S. dollars ($129,950), an amount equal to the Approximate Retail Value. The maximum number of Prizes available equals the number of Assessment Slots (ten (10)).

10.2 Award to Organization

Each Prize shall be awarded to the winning Participant organization and not to any individual. Prizes are non-transferable, except that the winning organization may direct titling or payment as it lawfully elects. Sponsor reserves the right to substitute a vehicle of equal or greater value if the advertised vehicle becomes unavailable.

10.3 Winner Notification; Verification

Sponsor shall notify each Winner in writing at the email address provided in the Entry. Each winner notification shall: (a) state Sponsor’s name and address clearly and conspicuously at the top of the notification, in bold type at least two (2) points larger than the type used in the body of the notification; (b) state that the notification is made in connection with a sales promotion conducted by Sponsor; (c) contain no solicitation for the sale or lease of any goods, property, or services; and (d) state the date on which the Prize will be awarded. As a condition of receiving a Prize, a Winner shall execute and return, within ten (10) business days after notification, an affidavit of eligibility, a liability release, a completed IRS Form W-9, and, except where prohibited by law, a publicity release. No purchase, payment, fee, or other consideration shall be required as a condition of receiving a Prize, and receipt of a Prize shall not be conditioned upon attendance at, or participation in, any sales presentation or product demonstration. Sponsor shall deliver or pay each Prize, at no expense to the Winner, within thirty (30) days after the winner notification, subject to the Winner’s timely completion of verification.

10.4 Taxes

The full value of any Prize constitutes taxable income to the winning organization under U.S. federal law and applicable state law. The Winner is solely responsible for all federal, state, and local taxes on the Prize. Sponsor shall report the value of each Prize to the Internal Revenue Service and shall issue each Winner an IRS Form 1099 reflecting the fair market value of the Prize. THE TAX LIABILITY ASSOCIATED WITH A PRIZE MAY BE SUBSTANTIAL. WINNERS ARE STRONGLY ENCOURAGED TO CONSULT A TAX PROFESSIONAL BEFORE ACCEPTING A PRIZE.

10.5 Title, Registration, and Delivery

Sponsor shall bear the cost of delivery of a vehicle Prize to the Winner’s business address within the continental United States, and shall pay a cash-alternative Prize by wire transfer at no cost to the Winner. Following delivery, the Winner is responsible for title, registration, licensing, and insurance of a vehicle Prize.

10.6 Point-of-Entry Disclosures

The following shall be displayed on the Challenge webpage together with the entry form and a link to these Rules: (a) the Prize description and Approximate Retail Value; (b) the number of Assessment Slots and the order-of-receipt allocation method; (c) a summary of the eligibility criteria in Section 4; (d) the tax notice in Section 10.4; (e) a statement that no purchase, payment, or event attendance is required to enter or win, together with the date and time at which the Entry Period opens; and (f) the statement of non-affiliation set forth in Section 14.1. In addition, all onsite and online materials referencing the Challenge shall state, clearly and conspicuously, that the Challenge is offered solely by Sponsor and is not sponsored, endorsed, administered by, or associated with Black Hat or Informa.

10.7 Advertising Standards

Each advertisement for the Challenge shall: (a) identify Sponsor as the party on whose behalf the Challenge is conducted and disclose all conditions a Participant must satisfy, or state clearly and conspicuously where these Rules may be obtained without charge; (b) display, clearly and conspicuously and adjacent to each description of the Prize, the actual retail value of the Prize (determined in accordance with NRS 598.137(7)), the maximum number of Prizes to be awarded, and a statement that outcomes are determined solely by the skill-based criteria set forth in these Rules; (c) not state or imply, prior to a declaration under Section 9.3, that any person has won a Prize, is a winner, or has been specially selected or chosen; and (d) not require any entrant to attend or listen to any sales presentation or product demonstration as a condition of entry.

11. Limited Grounds for Declination, Disqualification, and Withholding

11.1 Sponsor may decline to confirm, or may disqualify, a Participant only upon one or more of the following grounds:

(a) failure to satisfy or maintain any eligibility criterion set forth in Section 4;

(b) provision of false or misleading information in connection with the Challenge;

(c) failure to execute a Scope Agreement within the period set forth in Section 5.4 despite Sponsor’s good-faith efforts;

(d) restriction of code or environment access, or other conduct, that prevents a complete Assessment in accordance with the Scope Agreement;

(e) a bona fide legal, regulatory, sanctions-related, or conflict-of-interest impediment to conducting the Assessment, documented in writing to the Participant; or

(f) violation of applicable law or of these Rules.

11.2 Sponsor may withhold a Prize where the absence of a qualifying HSSV finding resulted from the Participant’s misrepresentation, obstruction of the Assessment, or material limitation of the agreed scope. Any withholding under this Section 11.2 is subject to independent review pursuant to Section 9.2 upon the Participant’s timely request.

11.3 Declination or disqualification under this Section 11 shall not entitle a Participant to any prize, compensation, or other benefit.

12. Findings; Confidentiality; Disclosure

12.1 All findings identified during an Assessment shall be made available to the applicable Participant via Sponsor’s dashboard, which shall constitute the complete written summary of the Assessment. Dashboard access shall remain available to the Participant for not less than twelve (12) months following completion of the Assessment.

12.2 Each party shall maintain the confidentiality of Assessment findings in accordance with the executed non-disclosure agreement. Sponsor shall not publicly disclose any vulnerability identified during an Assessment without the Participant’s prior written consent.

12.3 Sponsor may publicly announce the identity of a Winner only with the Winner’s consent or as otherwise permitted by law.

13. Disclaimers; Limitation of Liability

13.1 THE CHALLENGE AND EACH ASSESSMENT ARE PROVIDED “AS IS.” SPONSOR DOES NOT REPRESENT OR WARRANT THAT ANY ASSESSMENT WILL IDENTIFY ALL VULNERABILITIES PRESENT IN AN APPLICATION. A RESULT OF NO QUALIFYING FINDINGS IS NOT A CERTIFICATION, WARRANTY, OR REPRESENTATION THAT AN APPLICATION IS SECURE OR FREE OF VULNERABILITIES.

13.2 TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, SPONSOR SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES ARISING OUT OF OR RELATING TO THE CHALLENGE, ANY ASSESSMENT, OR RELIANCE ON ANY FINDINGS. NOTHING IN THESE RULES LIMITS LIABILITY THAT CANNOT BE LIMITED UNDER APPLICABLE LAW.

13.3 An Assessment is not a comprehensive security audit and is not a substitute for a security program.

14. No Event Affiliation; Release

14.1 The Challenge is offered, administered, and fulfilled solely by Sponsor. The Challenge is not sponsored, endorsed, or administered by, or associated with, Black Hat, Informa PLC, Informa Group Limited, any other event organizer or venue, Porsche AG, or Porsche Cars North America (collectively, together with their respective parents, subsidiaries, affiliates, officers, directors, employees, and agents, the “Event Parties”). Any permission granted by an event organizer for the collection of expressions of interest at Sponsor’s exhibit booth relates solely to Sponsor’s exhibitor activities and does not constitute sponsorship, endorsement, or administration of the Challenge. The Event Parties have no involvement in, and bear no responsibility or liability for, any aspect of the Challenge, including eligibility determinations, Assessments, outcomes, or Prize fulfillment.

14.2 Release; Covenant Not to Sue

Each Participant, on behalf of itself and its officers, directors, employees, and affiliates, irrevocably releases and forever discharges the Event Parties from all claims, demands, damages, losses, liabilities, and causes of action of any kind arising out of or relating to the Challenge, and covenants not to sue or otherwise assert any claim against any Event Party in connection with the Challenge. Each Participant’s sole recourse for any dispute arising from the Challenge is against Sponsor. The Event Parties are intended third-party beneficiaries of this Section 14 and may enforce it directly. Each Participant shall indemnify, defend, and hold harmless the Event Parties from and against all claims, losses, and expenses (including reasonable attorneys’ fees) arising from that Participant’s breach of this Section 14.

15. Suspension; Termination

If fraud, tampering, technical failure, or any other cause beyond Sponsor’s reasonable control compromises the integrity or proper administration of the Challenge, Sponsor may suspend the Challenge and resume it as soon as reasonably practicable. Sponsor may terminate the Challenge on such grounds only if the compromise cannot reasonably be remedied, in which case Sponsor shall complete, in accordance with these Rules, all Assessments commenced prior to termination and shall award all Prizes earned pursuant to Section 9 prior to termination. This Section 15 does not authorize suspension or termination on the basis of the number or cost of Prizes earned.

16. General Provisions

16.1 Governing Law; Venue

These Rules shall be governed by the laws of the State of Nevada, without regard to conflict-of-law principles. Any dispute arising out of or relating to the Challenge shall be resolved exclusively in the state or federal courts located in Clark County, Nevada, and each Participant consents to the personal jurisdiction and venue of such courts.

16.2 Amendment

Sponsor may amend these Rules prior to the opening of the Entry Period. Following the opening of the Entry Period, Sponsor may amend these Rules only as required by applicable law. The Rules in effect at the time of a Participant’s Entry shall govern that Participant, except as otherwise required by law.

16.3 Severability

If any provision of these Rules is held invalid or unenforceable, the remaining provisions shall continue in full force and effect.

16.4 No Waiver

Sponsor’s failure to enforce any provision of these Rules shall not constitute a waiver of that or any other provision.

16.5 Force Majeure

Sponsor shall not be liable for any failure or delay in performance resulting from causes beyond its reasonable control; provided that this Section 16.5 shall not excuse the award of a Prize earned pursuant to Section 9.

16.6 Privacy

Information submitted with an Entry shall be used to administer the Challenge and, where the entrant consents, for Sponsor’s marketing communications, in accordance with Sponsor’s Privacy Policy at verialabs.com/privacy.

16.7 Winners Record

Sponsor shall provide, without charge, a record of the names and addresses of the Winners to any person upon written request submitted after October 31, 2026 to the address in Section 17 or by email to contact@verialabs.com with the subject line “Challenge Winners List.” Each Winner consents to inclusion in such record as part of the publicity release described in Section 10.3, except where prohibited by law.

17. Sponsor Contact

Veria Labs, Inc.

2261 Market St STE 85941

San Francisco, CA 94114

Email: contact@verialabs.com