My Hacktoberfest 2026 experience
I signed up for Hacktoberfest with one project in mind.
I never built it.
I’d done Hacktoberfest before — back when it was about pull requests, hunting for repos, hitting a count. This year was different. No PRs. Instead: build a real project with open-source AI at its core, and write about it. Same event, completely new game — and I’ll be honest, I enjoyed this version far more. It pulled me somewhere I didn’t plan to go.
Over the month, I built five projects, experimented with AI tools I’d never touched, watched livestreams, talked to the people running the event, and — somewhere in there — figured out more about the kind of cybersecurity work I actually want to do than I had in months of studying. This was not the October I planned. It was better.
The detour
I’m transitioning from data analytics into SOC/detection work, and I came in thinking I knew exactly what I’d make. Then Week 2’s “Touch Grass” prompt landed, and suddenly I was building something I’d never have planned: The Security Dictionary: Trail Edition — a tool that turns security concepts like firewall and phishing into outdoor missions for kids, generated by a local model so the whole thing runs offline. I field-tested it with a kid in my target age range. She went looking for a fence in the backyard to understand “firewall.” That wasn’t on my roadmap. It was the best thing I made that week.
That set the tone. Each prompt pulled me somewhere I wouldn’t have gone alone:
- AlertCadence — turns raw security advisories into plain-English briefs a small business can actually read. (Live at alertcadence.tech.)
- Does This Belong Here? — a phishing checker for the non-technical people in my life who get those sketchy texts.
- Event ID Decoder — explains Windows Security Event IDs in plain English, built during Global Hack Week (my first time ever doing GHW).
- The Rootkit Exorcist — a Python tool that scans scripts for suspicious patterns, maps findings to MITRE ATT&CK, and uses a local Llama model for investigation notes. It has a SOC Mode and, because it was nearly Halloween, an Exorcist Mode featuring Father Llama. The power of chmod compels you. 👻
Five real builds. Not one of them was the project I walked in with.
The thread that tied it all together
Here’s the thing I didn’t expect to learn, and the thing I’ll carry past Hacktoberfest: AI was most useful when it guided, not when it did everything.
Every one of these ran on a local, open-weight model — Gemma, Llama — through Ollama. And across all of them, the same lesson kept surfacing. When a small model was unreliable — leaking technical detail, sometimes inventing things — the fix was never a cleverer prompt. It was giving the model a smaller, well-scoped job and keeping the judgment in code I controlled. Extract the clean facts first. Let the model only rephrase them. It can’t invent what it never receives.
The Rootkit Exorcist made that explicit, right in its design: it maps real findings to ATT&CK deterministically, and then asks the model to help explain them — never the other way around. Its one rule is the one I’d put on a sticky note: AI explanations are not a substitute for verified evidence.
That’s not just a building lesson. That’s the actual instinct of the SOC work I’m moving toward — the analyst verifies; the tool assists. I came in to build projects. I left understanding the job better.
The part I didn’t expect: the people
I thought this was a solo coding sprint. It wasn’t.
I watched the livestreams and kept running into tools I’d never have found on my own. The Hacktoberfest team engaged with my progress posts. The official account reposted my work. I had a real conversation with someone on the program team. Sharing the month in public — out loud, as I went — turned a solo challenge into something that felt like a community.
I kept going. I didn’t stop at one build, or two. When Global Hack Week’s challenges reopened for one extra day, and I was a single point short of my final sticker, I came back and earned it.
At the closing ceremony, the numbers landed: 115,385 participants. 15,000+ projects. And 503 people reached Completionist++. I found out, right there, that I was one of them.
What I’m taking with me
My original plan never got built, and I don’t regret it for a second. I built more than I expected, learned things no tutorial would have taught me, and found a clearer sense of direction by making things I hadn’t planned to make.
I’d done Hacktoberfest before. This year, it became something I’ll actually remember.
The tool changes. The question doesn’t. 💜
Built in public by DataSec Chronicles.
Top comments (0)