Skip to content
  1. registrationnow
  2. live
  3. results

The Fine Print

Terms

What taking part in this competition commits you to. Short, and specific to the CTF. The OWASP Foundation's own policies govern everything beyond it.

What governs what

This page covers participation in the CTF. Beyond it, the OWASP Foundation's General Disclaimer applies to this site and its content, including that everything here is provided without warranty of service or accuracy. Conduct is governed by the code of conduct, and what this site stores about you is described in the privacy notice. Competition mechanics live in the rules.

Eligibility

  • You need a GitHub account. Your GitHub login is your identity for scoring, so open every pull request from the account you sign in with. Points are credited to the PR author and cannot be moved between accounts afterwards.
  • Organizers and anyone who worked on the challenge targets, the scorer, or the rubric may compete for fun but are not eligible for prizes.
  • You need a GitHub account. Your GitHub login is your identity for scoring, so answer from the account you sign in with. Points are credited to the account that submitted the answer and cannot be moved between accounts afterwards.
  • Organizers and anyone who wrote or reviewed the questions may compete for fun but are not eligible for prizes.
  • You need a GitHub account. Your GitHub login is your identity for scoring, so submit every flag from the account you sign in with. Points are credited to that account and cannot be moved between accounts afterwards.
  • Organizers and anyone who wrote or reviewed the flags may compete for fun but are not eligible for prizes.
  • You need a GitHub account. Your GitHub login is your identity for scoring — it's also what your personal launch link carries onto the external site — and points are credited to that account and cannot be moved between accounts afterwards.
  • Organizers and anyone who wrote or reviewed the challenges may compete for fun but are not eligible for prizes.

Scope of authorized testing

  • Your authorization to test covers the 6 challenge targets only: Juice Shop, DVWA, WebGoat, Security Shepherd, VulnerableApp, and VAmPI, in your own fork under the kavacon-ctf-2026 organization.
  • Explicitly out of scope: the CI scoring pipeline, the leaderboard, this website, the CTF Discord, and other contestants' accounts, forks, or machines. Testing any of those is not authorized by this event, and nothing here should be read as permission to do so.
  • Found a real vulnerability in the scorer or this site? That is genuinely useful. Report it to an organizer rather than exploiting it. Doing so will not cost you anything.
  • Automated mass-submission, or spamming pull requests to farm scoring runs, will get your account rate-limited or disqualified.
  • This event authorizes no testing of any system. The published questions are the whole game, and answering them is the whole of what you are invited to do here.
  • Explicitly out of scope: the scoring pipeline, the leaderboard, this website, the CTF Discord, and other contestants' accounts or machines. Testing any of those is not authorized by this event, and nothing here should be read as permission to do so.
  • Found a real security bug in this site or in the scoring pipeline? That is genuinely useful. Report it to an organizer rather than exploiting it. Doing so will not cost you anything.
  • Automated or scripted answering, to farm attempts or to enumerate the answer key, will get your account rate-limited or disqualified.
  • This event authorizes no testing of any system. The published flags are the whole of what you're invited to do here.
  • Explicitly out of scope: the scoring pipeline, the leaderboard, this website, the CTF Discord, and other contestants' accounts or machines. Testing any of those is not authorized by this event, and nothing here should be read as permission to do so.
  • Found a real security bug in this site or in the scoring pipeline? That is genuinely useful. Report it to an organizer rather than exploiting it. Doing so will not cost you anything.
  • Automated or scripted submission, to farm attempts or to enumerate flags, will get your account rate-limited or disqualified.
  • This event authorizes no testing of any system. The published challenges are the whole of what you're invited to do here, on whichever external site each one names.
  • Explicitly out of scope: the scoring pipeline, the leaderboard, this website, the CTF Discord, and other contestants' accounts or launch links. Testing any of those is not authorized by this event, and nothing here should be read as permission to do so.
  • Found a real security bug in this site or in the scoring pipeline? That is genuinely useful. Report it to an organizer rather than exploiting it. Doing so will not cost you anything.
  • Automated or scripted play, to farm attempts or to enumerate flags, will get your account rate-limited or disqualified.

Your submissions

  • You submit work as a pull request against the target repository's ctf branch. Those repositories are OWASP projects under their own existing open-source licenses, and your contribution is offered under the license of the repository you are contributing to.
  • Submit your own work. Using AI tooling to find and fix vulnerabilities is expected and encouraged here (see the Rules), but passing off another contestant's patch as yours is not.
  • Don't publish full solutions or patches for others to copy while the event is running. Afterwards, write up whatever you like.
  • Organizers may reference or showcase submitted patches when talking about the event.
  • You submit work by answering the published questions. Each answer is graded automatically against a stored answer key the moment you submit it.
  • Submit your own work. Passing off another contestant's answers as yours is not allowed.
  • Don't publish answers for others to copy while the event is running. Afterwards, write up whatever you like.
  • You submit work by finding and entering the flag for each one you solve. Each submission is graded automatically against the stored answer the moment you submit it.
  • Submit your own work. Passing off another contestant's flag as yours is not allowed.
  • Don't publish flags or writeups for others to copy while the event is running. Afterwards, write up whatever you like.
  • Playing an external challenge sends your GitHub login and your progress on this module to that challenge's operator — that is what your personal launch link carries, and it's how the site knows you and can report your solve back.
  • Submit your own work. Passing off another contestant's solve as yours is not allowed, and neither is playing under someone else's launch link.
  • Don't publish flags or writeups for others to copy while the event is running. Afterwards, write up whatever you like.

Scoring and prizes

  • Each challenge is worth a fixed point value based on difficulty, awarded automatically when that challenge's regression test passes against your patched app. Your best-ever result per challenge counts.
  • Revealing a hint deducts points from your leaderboard total. Hint purchases are final. There is no refund.
  • Each question is worth a fixed point value, set by the organizers, awarded automatically the moment a correct answer is submitted. Your best-ever result per question counts.
  • A question can be capped to a limited number of attempts and can hold you on a cooldown between tries. Attempts are final: there is no refund and no reset.
  • Each flag is worth a fixed point value, set by whoever wrote it, awarded automatically the instant a correct submission is graded. That value doesn't change as more people solve it.
  • There is no cap on attempts. A short cooldown between submissions on the same flag may apply, and organizers may adjust it during the event.
  • Revealing a hint deducts points from your leaderboard total. Hint purchases are final. There is no refund.
  • Each challenge is worth a fixed point value, set by whoever wrote it, awarded automatically when your solve is recorded — whether the external site reported it or you submitted a matching flag. Your best-ever result per challenge counts.
  • There is no cap on attempts. A short, fixed cooldown applies between wrong submissions on the same challenge.
  • Revealing a hint deducts points from your leaderboard total. Hint purchases are final. There is no refund.
  • Prizes go to the top individuals and top teams overall. You must be present at the closing ceremony to claim.
  • Organizer decisions on scoring disputes are final.

Questions about any of this? Ask an organizer at the Kavacon CTF 2026 By OWASP area.