Secure Development · Quiz · Jeopardy · AI
Nov 10 – Nov 13, 2026 · Asunción, Paraguay
CTF opens
Break real vulnerabilities in 6 deliberately vulnerable training apps, patch them for real, and ship the fix as a GitHub pull request. CI validates your patch and scores it automatically. Practice the full secure development lifecycle, not just flag-hunting.
321 challenges · 6 apps
Answer security questions for points. Every question carries its own point value, is graded the moment you submit it, and counts toward your place on the leaderboard.
10 questions
Find each flag and submit it for points. Every flag carries its own point value, grading happens the instant you submit, and matching ignores leading or trailing whitespace and — unless a flag is marked case-sensitive on its card — capitalisation too.
22 flags
Each challenge is hosted on an external site. Open it from its page for a personal launch link, play it there, and a correct solve reports back to the leaderboard on its own — or, where a challenge also takes one, grade yourself by typing the flag on the page.
Bring your agent
This isn’t tolerated, it’s the point. Reviewing code, finding the flaw, and writing the patch with an AI agent is the skill this event exists to build. Bring whatever you already use (Claude Code, Copilot, Cursor, your own harness) and let it read the target.
OWASP’s own open-source playbook for pointing an AI agent at a codebase. It ships structured, OWASP-grounded procedures for security code review, dependency and secrets scanning, and API and web assessment, each one mapped to the same OWASP Top 10 categories these challenges are graded against. It turns “find the bug” into a repeatable method, which is exactly what you want against 300-plus challenges on a deadline.
6 real targets
Each app is a well-known, deliberately vulnerable open-source project. Points scale with difficulty, and the deeper flaws in VulnerableApp, and Juice Shop pay out the most.
Damn Vulnerable Web Application: PHP classics at three security levels.
The classic deliberately-insecure web shop. OWASP Web Top 10.
Web and mobile security training platform with layered challenge levels.
Vulnerable REST API: the OWASP API Security Top 10 track.
OWASP's extensible vulnerability playground with the deepest challenge pool.
OWASP's guided insecure Java app with lesson-driven exploitation and fixes.
This event runs on OWASP CTF in a Box: one machine, one free GitHub org, no cloud account, scoring rubrics included. A university course, a chapter night or a weekend workshop can stand it up in an afternoon.
