Break real code. Then fix it.
A capture-the-flag built on the vulnerabilities we find in production, where the flag is only half the points
Five tracks, one idea
Every challenge is a running service with the repository behind it. Different skill, same discipline: read the code, prove the bug, close it for good.
Web
Injection, access control, deserialization and the boring bugs that ship. Full apps, real routers, one path that matters.
Pwn
Memory corruption and logic flaws in services you get to run locally. Understand the crash before you weaponize it.
Crypto
Misused primitives, weak randomness and protocol mistakes. Break the assumption, not the maths.
Reverse
Binaries and bytecode with the source withheld. Recover the intent, then find where it lies to you.
Cloud
Over-permissioned roles, leaky metadata and pipelines that trust the wrong input. The attack surface nobody reviews.
How a challenge works
The flag is the easy half. The points are in the patch that holds.
Read the repository
You get the whole service, not a snippet. Find the entry points, follow untrusted input, and decide which finding is actually reachable.
Capture the flag
Prove the bug against the running instance. The flag confirms you found the path and can trigger it under real conditions.
Ship the fix
Submit a patch. We apply it to a clean checkout, run the tests, and rescan. Points land only when the bug is gone and the build is green.
Get in the first cohort
Challenges, scoreboards and team play land through the year. Follow along and claim your spot early.