The Sandbox

LeetCode, but for real startup problems. A privacy-first platform that securely turns startup problems into anonymous coding challenges for student developers to prove their skills.

Comment

Hackathon Summary

Chosen Problem Statement

Opportunity access is socially gated — How might we redesign opportunity discovery so access is driven less by social capital and more by demonstrated potential?

Project Summary

The Sandbox is a platform that bridges the gap between hiring needs and student engineering talent by safely converting real-world startup backlog bugs into anonymous, privacy-protected coding challenges. To guarantee absolute zero-trust security, a local data proxy automatically strips PII and sensitive data on the company's machine before an AI-driven agentic pipeline scaffolds the issue into structured starter code and project briefs. Students can then read requirements and implement their solutions directly within an integrated multi-file browser IDE, where their code is safely evaluated against test suites inside isolated Docker containers.

Target User

Startups (CTOs & Founders): Small-to-midsize tech companies that want to build high-quality, practical engineering talent pipelines but lack the time to manually write custom case studies or screen hundreds of resumes. They need a safe way to evaluate candidates against their actual internal codebase constraints without leaking proprietary code or operational roadmaps.

Students & Aspiring Developers: High-potential engineering students who want to break into the tech industry based entirely on merit. They need a direct "proof-of-work" protocol to bypass resume screens and algorithmic brain-teasers, allowing them to gain and demonstrate real-world, practical system-engineering skills.

Details

Inspiration

The idea for Sandbox Zero was born out of a stark paradox I witnessed while immersing myself in the startup ecosystem.

On one side, early-stage startups are drowning in unaddressed product and operational debt. They have fascinating, high-leverage problems, but their core teams simply lack the bandwidth to tackle them. They can’t open-source them either, because exposing raw production logs or proprietary roadmaps is a massive corporate vulnerability.

On the other side, the university ecosystem is overflowing with brilliant engineering minds looking for real-world scar tissue. They don't want to build another generic clone of a social media app for their portfolio; they want to solve industry-worthy challenges. Yet, without a pedigreed network or an aggressive referral connection, the top tier of tech remains inaccessible, especially for introverted developers who excel at execution but get filtered out by broken traditional recruiting channels.

So why not build a platform that safely mediates this relationship? The Sandbox acts as that trusted protocol. We ingest real corporate friction, strip out the PII and strategic signatures, and output high-utility system modules for students to conquer. It’s a blind audition for software engineering where code speaks louder than resumes.

Think of it as the real-world systems equivalent of LeetCode, designed to unlock hidden talent.

What it does

The Sandbox is a platform that lets startups turn their real internal bugs and backlog tasks into anonymous coding challenges. Students solve these challenges to prove their technical skills directly with code, bypassing traditional resume filters and job applications.

Local Data Scrubbing: To protect sensitive company information, logs, emails, and internal names are cleaned up directly on the startup's machine before any data is uploaded. Only safe, abstract summaries ever leave their network.

Automated Challenge Generation: When a startup submits an internal issue, our backend analyzes it and creates a public-ready coding challenge, generating structured project specifications (docs/SPEC.md) and starter code files.

Anonymous "Blind Auditions": Startups remain entirely anonymous to prevent hiring bias and protect proprietary roadmaps. The platform can even rephrase highly specific business scenarios into neutral, everyday technical tasks (e.g., rewriting a food-delivery bug into an equipment-rental system challenge).

Built-in Code Workspace: Students read the challenge requirements and write their solutions directly in the browser using an integrated text editor powered by Monaco (the same engine behind VS Code).

Two-Part Grading System: Submissions receive two separate scores: Platform Signal (whether the code successfully passes automated functionality and security tests inside an isolated Docker container) and Sponsor Fit (how closely the implementation matches that specific startup’s constraints).

How we built it

I built The Sandbox using a modular architecture divided into local data sanitization, an AI-assisted management pipeline, and an isolated execution environment for grading submissions.

Offline-First Privacy: Our data pipeline strictly separates content ingestion from cloud processing. The local proxy strips out personally identifiable information (PII) before formatting the data, meaning raw corporate files never touch our external cloud servers.

Flexible AI Routing: The system features dual-mode AI logic. By default, it leverages OpenAI's API (gpt-4o-mini) to handle challenge drafting and triage. For strict privacy requirements, it can route completely locally via a self-hosted vLLM server running Qwen2.5-7B to keep all data inside the local network.

Template-Driven Scaffolding: To avoid AI generation errors or broken code stubs, the backend categorizes incoming problems into specific system archetypes (like idempotency_engine or webhook_handler). It then maps these to structured code templates, ensuring the generated starter kits are completely reliable.

Challenges we ran into

Lifecycle Inversion & Prompt Drift: During development, I observed a behavioral divergence between our static, hardcoded demo seed states and items generated dynamically on the fly. This structural mismatch initially caused the AI Product Manager to produce unstructured, drifting Micro-PRD specifications that mismatched the execution requirements.

Scaffold Generation Precision: Instructing an LLM agent to reliably output highly specific, deterministic code stubs, interface rules, and companion starter test files proved incredibly challenging. Overcoming this required evolving our prompt architectures from open-ended text generations into rigorous JSON data contracts.

Threading the Needle in the Technical Landscape: We spent significant time mapping the exact product market fit for our platform. I had to carefully define how our tasks differ from LeetCode (which tests syntax memorization) and massive open-source codebases (which impose massive cognitive overhead).

Quantifying "Subjective" Engineering Merit: Creating a robust, automated grading rubric for subjective code architectures is incredibly difficult. I addressed this by designing a dual-layer scorecard that explicitly splits objective runtime criteria from semantic sponsor criteria.

Accomplishments that we're proud of

End-to-End Orchestrated Pipeline: I successfully built a multi-stage automated pipeline that seamlessly bridges local privacy proxy sanitization, AI-driven triage scoring, and programmatic challenge package building into a single unified workspace.

Production-Grade Workspace Experience: I integrated the full Monaco Editor framework into my frontend layout. This provides students with an authentic, browser-based IDE workspace complete with file persistence and localized text execution.

A Novel Paradigm for Talent Pipelines: I aim to illustrate that you can fundamentally re-engineer traditional corporate technical hiring. The platform validates true architectural design choices while natively protecting an enterprise's code perimeter and roadmaps from strategic public leaks.

What we learned

Secure Ephemeral Code Isolation: I gained deep experience orchestrating isolated runtime environments using Docker containers to securely process, boundary-test, and evaluate untrusted student code submissions without exposing the underlying host system.

Extensibility of the Monaco Ecosystem: I discovered how powerful the Monaco Editor engine is when customized for targeted user experiences. It provides an excellent architectural foundation to layer on personalized terminal telemetry or interactive execution aids.

Client-Side Privacy Preservation: I validated the architectural pattern that user data privacy does not require sacrificing cloud intelligence. By performing regex and Named Entity Recognition processing locally on the client's machine, the raw data payload is completely de-risked before any cloud API boundaries are crossed.

What's next for The Sandbox

Multi-Disciplinary Vertical Expansion: I plan to expand past software engineering into high-leverage domains like quantitative finance, algorithmic economic modeling, marketing, and product strategy tracks, acting as the definitive work-simulation engine for global industries.

Native VCS Pipeline Integration (GitHub & GitLab): Rather than trying to scale a custom in-browser editor to handle massive codebases, our next milestone is to completely decouple the development environment from our UI. I want to allow students to interact with challenges natively via Git. The platform will automatically spin up anonymized, read-only upstream repository forks. Students will clone the code locally, build the solution inside their own local IDEs (VS Code, Cursor, etc.), and trigger our Docker assessment loop seamlessly on every git push or Pull Request submission.

Dynamic "Chaos Monkey" Constraints (Context Adaptability): AI excels at solving static problem statements, but struggles when business logic shifts mid-execution.

The Mechanism: Once a student runs their first successful test batch, the platform introduces an unexpected, real-time operational constraint based on their challenge archetype (e.g. "The downstream third-party API just dropped rate limits by 80%. Refactor your solution to handle the queue without dropping events").

The Goal: This forces the developer to dynamically adapt their AI context windows and prompting strategies on the fly, proving they understand system trade-offs rather than just copying a single pre-baked answer.

Automated "Implementation Defenses" (The Async Code Review): An engineer must be able to defend the code they deploy. Immediately after clicking submit, the platform generates a high-precision, async text review targeting the student's exact lines of code.

The Mechanism: The AI Assessor scans the final code submission and generates three highly specific, short-answer questions tailored to their implementation choices (e.g. "In line 47, your generated solution uses an unbuffered channel. Explain why that choice was made here and what happens if the consumer blocks").

The Goal: The student has a tight time window to answer. This acts as a scalable, async technical interview, instantly filtering out people who blind-prompted an LLM without understanding the structural decisions behind the generated code.

Built With

Share this project:

Updates