There was a 3 round loop, one of which is a code review. There was an interesting java application. The vulnerabilities are not that hard to identify. They gave me a vs code instance with the application code. It's a complete web application.