Secure Development CTF
CTF opens
Break real vulnerabilities in six OWASP training apps, patch them for real, and ship the fix as a GitHub pull request. CI validates your patch and scores it automatically. Practice the full secure development lifecycle, not just flag-hunting.
What to expect
Every challenge maps to a real, disclosed vulnerability class from the OWASP Top 10. You find it, patch it, and prove the fix with a passing regression test, the same loop a security engineer runs against a live codebase.
Choose from six real, deliberately vulnerable OWASP apps: Juice Shop, DVWA, WebGoat, Security Shepherd, VulnerableApp, and VAmPI.
Work through the OWASP Top 10 (Web and API) to identify a real flaw in the target's source. Please use AI. Point an agent at the codebase. That's the workflow this event is built to teach.
Fix the vulnerability in your fork, then submit a pull request against the repo's dc34-ctf branch. This is secure development, not flag hunting.
A GitHub Action runs that challenge's regression test against your patched app. A passing test scores points immediately, no manual grading.
Bring your agent
This isn’t tolerated, it’s the point. Reviewing code, finding the flaw, and writing the patch with an AI agent is the skill this event exists to build. Bring whatever you already use (Claude Code, Copilot, Cursor, your own harness) and let it read the target.
OWASP’s own open-source playbook for pointing an AI agent at a codebase. It ships structured, OWASP-grounded procedures for security code review, dependency and secrets scanning, and API and web assessment, each one mapped to the same OWASP Top 10 categories these challenges are graded against. It turns “find the bug” into a repeatable method, which is exactly what you want against 300-plus challenges on a deadline.
Six real targets
Each app is a well-known, deliberately vulnerable OWASP project. Points scale with difficulty, and the deeper flaws in VulnerableApp and WebGoat pay out the most.
Damn Vulnerable Web Application: PHP classics at three security levels.
The classic deliberately-insecure web shop. OWASP Web Top 10.
Web and mobile security training platform with layered challenge levels.
Vulnerable REST API: the OWASP API Security Top 10 track.
OWASP's extensible vulnerability playground with the deepest challenge pool.
OWASP's guided insecure Java app with lesson-driven exploitation and fixes.
Sign in with GitHub to claim your row on the leaderboard, follow your patched and non-patched count per app on your profile, and team up with other contestants.