Skip to content
  1. registrationnow
  2. live
  3. results

The Fine Print

Rules

Keep the competition fair and the community welcoming. Breaking these can cost points or your spot in the event.

Teams

  • Scoring is per team, and you need one before anything you solve counts. Compete solo with a one-click team of one, or in a team of up to four — create or join one from your profile after signing in with GitHub.
  • Each person belongs to at most one team at a time.
  • Your GitHub login is your identity for scoring — everything you submit counts for the account you signed in with.
  • Points for a patch credit the pull request's author — open every PR from the same GitHub account you sign in with, or your score lands on a row you can't see.

Fair play

  • Only the 6 challenge targets (Juice Shop, DVWA, WebGoat, Security Shepherd, VulnerableApp, and VAmPI) are in scope. Do not attack the CI scoring pipeline, the leaderboard, or other contestants' forks.
  • Submit your own work. Don't publish full solutions or patches for others to copy during the event.
  • Automated mass-submission or spamming pull requests to farm scoring runs will get your account rate-limited or disqualified.
  • Please use AI. Finding and patching these vulnerabilities with an AI agent is the intended workflow, not a shortcut against the rules. It's the skill the event is built to teach. Start with OWASP's Secure Agent Playbook.
  • The published questions are the whole game. Do not attack the scoring pipeline, the leaderboard, or other contestants' accounts.
  • Submit your own work. Don't publish answers for others to copy during the event.
  • Automated or scripted answering to farm attempts will get your account rate-limited or disqualified.
  • The published flags are the whole game. Do not attack the scoring pipeline, the leaderboard, or other contestants' accounts.
  • Submit your own work. Don't publish flags or writeups for others to copy during the event.
  • Automated or scripted submission to farm attempts will get your account rate-limited or disqualified.
  • The published challenges are the whole game. Do not attack the scoring pipeline, the leaderboard, or other contestants' accounts.
  • Your launch link is personal. Do not share it: anyone holding it can play or submit as you, cooldown included, and every point it earns still lands on your account regardless of who used it.
  • Automated or scripted play to farm attempts will get your account rate-limited or disqualified.

Conduct

  • The OWASP Code of Conduct applies at all times. Harassment of any kind ends your event. See our code of conduct page for how to report a problem.
  • Be excellent to the volunteers, organizers, and your fellow competitors.
  • Found a bug in a challenge, the scorer, or the site itself? Report it to an organizer instead of exploiting it for an unfair edge.
  • Found a bug in a question, the scoring pipeline, or the site itself? Report it to an organizer instead of exploiting it for an unfair edge.
  • Found a bug in a flag, the scoring pipeline, or the site itself? Report it to an organizer instead of exploiting it for an unfair edge.
  • Found a bug in a challenge, the scoring pipeline, or the site itself? Report it to an organizer instead of exploiting it for an unfair edge.

Scoring & prizes

  • Each challenge is worth a fixed point value based on difficulty. Points post once the event receives your PR's passing result, usually a few minutes after the push, but a points tie is decided on the time the result was posted on your PR. A result posted while scoring is frozen or closed does not count, even if the event receives it later.
  • Your best-ever result per challenge counts. A later successful patch always replaces an earlier miss.
  • Revealing a hint deducts points from your total, and hint purchases are final.
  • Each question is worth a fixed point value, set by the organizers. Points post the moment a correct answer is submitted.
  • A question can be capped to a limited number of attempts and can hold you on a cooldown between tries. Once you have answered it correctly, it is done.
  • Each flag is worth a fixed point value, set by whoever wrote it, and that value doesn't change as more people solve it.
  • Points post the instant a correct flag is submitted. There's no cap on attempts, though a short cooldown between submissions on the same flag may apply.
  • Revealing a hint deducts points from your total, and hint purchases are final.
  • Each challenge is worth a fixed point value, set by whoever wrote it. Points post the moment your solve is recorded, whether the external site reported it or you submitted a matching flag.
  • The box's own clock decides when a solve happened, not the external site's.
  • Revealing a hint deducts points from your total, and hint purchases are final.
  • Individuals and teams are ranked by points; ties go to more items completed, then to whoever earned their last points first, in any module.
  • Prizes are awarded to the top individuals and top teams overall. Winners must be present to claim.
  • Organizer decisions on scoring disputes are final.

Stuck, or need an organizer? Find one at the Kavacon CTF 2026 By OWASP area. See also the terms and privacy notice.