Rules of engagement
Terms & Fair Play
By creating an account or submitting a flag you agree to these terms. They exist so the scoreboard means something.
Last updated 2 September 2026
The short version: one account, play only the challenges through their intended targets, keep flags and solutions inside your team until the event ends, and don’t attack the platform or other players.
01Accounts
- One account per person. Duplicate accounts are removed and their solves voided.
- Register with an email address you control; it is how we reach you and how invite links find you.
- Your username is public. Keep it free of impersonation, slurs and anything that would embarrass your school or employer.
- You are responsible for everything done from your account. Don’t share your password.
02Teams
- Team size is set per event by the organisers and enforced automatically.
- Invite links and codes are for your teammates only. Anyone who opens one joins your team — treat it like a key.
- A player can be on one team at a time. Team changes may be locked while an event is live.
- Team score counts each challenge once, whoever on the team solved it. Ties break on the earliest solve.
03Fair play
Allowed: anything the challenge intends — reverse engineering, exploitation, cryptanalysis, forensics and research against the challenge targets themselves.
Not allowed, and grounds for removal of solves, a ban, or disqualification of the whole team:
- Sharing flags or solutions with other teams, or publishing them, before the event ends.
- Attacking the platform — the scoreboard, submission system, accounts, hosting, or anything not explicitly designated as a challenge target.
- Attacking other players or teams, their infrastructure, or their sessions.
- Brute-forcing the flag form. Attempt limits and cooldowns are enforced automatically; scripting around them is cheating.
- Denial of service against challenge targets, including excessive automated traffic.
- Buying, selling or trading flags, hints or accounts.
Found a vulnerability in the platform itself? Don’t exploit it — report it. See Support → Security issues. Good-faith reports are welcome.
04Hints and scoring
- Hints cost points. Unlocking one is final and is deducted from what the challenge is worth to you.
- Points, attempt limits and cooldowns are set per challenge by the organisers and can change before an event starts.
- The scoreboard may be frozen near the end of an event. Solves still count; positions are revealed when it unfreezes.
- Organiser rulings on scoring, disputes and conduct are final.
05Content
Challenges, hints and platform content belong to the organisers and their authors. You may keep notes and publish write-ups after the event ends; credit the challenge author where known.
06Availability and liability
The platform is provided as-is for the purposes of the competition. We work hard to keep it up during events but do not guarantee uninterrupted availability, and we are not liable for lost solves, lost time or anything you do with the skills you practise here. Use what you learn lawfully.
07Changes and contact
We may update these terms; the date above tells you when. Questions: [email protected]. See also the Privacy Policy.