Secure Development · Quiz · Jeopardy · AI
Nov 9 – Nov 13, 2026 · Asunción, Paraguay
Break real vulnerabilities in 2 deliberately vulnerable training apps, patch them for real, and ship the fix as a GitHub pull request. CI validates your patch and scores it automatically. Practice the full secure development lifecycle, not just flag-hunting.
64 challenges · 2 apps
Browse targetsAnswer security questions for points. Every question carries its own point value, is graded the moment you submit it, and counts toward your place on the leaderboard.
15 questions
Take the quizFind each flag and submit it for points. Every flag carries its own point value, grading happens the instant you submit, and matching ignores leading or trailing whitespace and — unless a flag is marked case-sensitive on its card — capitalisation too.
33 flags
Browse the flagsEach challenge is hosted on an external site. Open it from its page for a personal launch link, play it there, and a correct solve reports back to the leaderboard on its own — or, where a challenge also takes one, grade yourself by typing the flag on the page.
Browse the challengesBring your agent
This isn’t tolerated, it’s the point. Reviewing code, finding the flaw, and writing the patch with an AI agent is the skill this event exists to build. Bring whatever you already use (Claude Code, Copilot, Cursor, your own harness) and let it read the target.
OWASP’s own open-source playbook for pointing an AI agent at a codebase. It ships structured, OWASP-grounded procedures for security code review, dependency and secrets scanning, and API and web assessment, each one mapped to the same OWASP Top 10 categories these challenges are graded against. It turns “find the bug” into a repeatable method, which is exactly what you want against 300-plus challenges on a deadline.
2 real targets
Each app is a well-known, deliberately vulnerable open-source project. Points scale with difficulty, and the deeper flaws in DVWA, and VAmPI pay out the most.
This event runs on OWASP CTF in a Box: one machine, one free GitHub org, no cloud account, scoring rubrics included. A university course, a chapter night or a weekend workshop can stand it up in an afternoon.
