No starting hints, no region of code marked as interesting, no human in the loop after the budget started. The findings ranged from a chained second-order SQL injection (whose three constituent ...