📋

Competition Rules

Please read carefully. Participation implies acceptance of all rules.

Last updated: February 18, 2026

Ethical Conduct

  • › All participants must compete ethically, honestly, and in good faith at all times.
  • › Attacking the CTF platform, shared infrastructure, or any third-party system is strictly prohibited and may result in legal action.
  • › DoS attacks against challenge servers or other participants are immediate disqualification offences.
  • › Harassment, social engineering, or intimidation of participants or organizers will result in a permanent ban.

Flag Policy

  • › All flags follow the format: aSEC{...} unless explicitly stated otherwise per challenge.
  • › Sharing, selling, or buying flags from other teams is forbidden — all parties will be disqualified.
  • › Automated brute-forcing of the submission endpoint is prohibited. Rate limits are enforced server-side.
  • › First blood is awarded to the first verified correct submission. Ties are broken by server timestamp.

Teams

  • › Maximum team size: 5 players.
  • › Each participant may only belong to one team during the competition.
  • › Team roster changes after the competition begins are not permitted.
  • › Solo participation is fully supported — no team is required.

Scoring

  • › Points are awarded on the first correct flag submission for each challenge.
  • › Dynamic scoring may apply: high-solve challenges decrease in value over time.
  • › Ties in total score are broken by the timestamp of the final correct submission.
  • › Unlocking a hint deducts the stated point cost from your score immediately.

Responsible Disclosure

  • › If you find an unintended vulnerability in the CTF platform, report it to organizers — do not exploit it.
  • › All challenge vulnerabilities are intentional. Do not attempt to pivot beyond the challenge sandbox.
  • › Organizers may patch challenges mid-competition if critical bugs are found. Scoring adjustments may apply.

Prizes

  • › Winners will be contacted via registered email within 5 business days of competition close.
  • › Winners may be required to verify their identity before prizes are awarded.
  • › Prizes may be rescinded if post-competition cheating investigation reveals rule violations.
  • › Organizer decisions regarding disqualification and prizes are final.
🤝

Play Fair. Hack Smart.

The aSecurity CTF community thrives on trust, integrity, and the shared love of security research.

Questions? Contact admin@asecurity.ctf