Privacy notice

The OWASP Foundation's Privacy Policy is the governing document and covers OWASP as a whole. This page is narrower and more specific: it describes what this competition site does, because a general policy can't tell you what happens to a hint purchase or a GitHub login on a leaderboard.

Most of this site needs nothing from you

• Browsing the challenges, the leaderboard, the rules, and these policy pages requires no account and no sign-in. Nothing personal is collected while you read.
• Sign in only if you want to claim your row on the leaderboard, see your own per-challenge breakdown, join a team, or reveal a hint. Working through the challenges without ever signing in is a perfectly valid way to use this event.

Signing in with GitHub

We use GitHub OAuth and ask for the two narrowest scopes available: read:user and user:email. Both are read-only.

• GitHub hands us your login, numeric account id, display name, avatar URL, and email address.
• Of those we keep exactly one: your GitHub login, because the scorer credits points to the account that authored a pull request. Completing sign-in records that login (with a timestamp) so your name appears on the leaderboard right away, before your first scored pull request. The rest renders the page you're on and is then forgotten.
• We deliberately do not store the access token GitHub issues at sign-in. This app never calls the GitHub API, so keeping that token would mean holding a credential we have no use for.
• There is no account database. Your session lives entirely in an encrypted cookie; once it expires, all that remains on our side is the leaderboard registration above — your public login and when you first signed in, nothing else.

What we store while you compete

• Leaderboard registration: your GitHub login and the time you first signed in, so your name shows on the leaderboard before your first scored pull request.
• Team membership: the team's name, who created it, and the GitHub logins of its members.
• Hint purchases: which hints you revealed, when, and the running point penalty against your login.
• Your scores come from the scoring pipeline, keyed to the GitHub login that authored the pull request. This site reads them; it doesn't create them.

All of it is keyed to a public GitHub username and nothing more: no email, no real name, no device or location data. It lives in an AWS DynamoDB table and an Upstash Redis instance run for this event. Being straight with you: this competition data has no automatic expiry today, so treat it as kept until the organizers clear it down after the event. You can ask for yours sooner. See below.

Protecting the challenge board

Before the board opens it sits behind a password, and to stop that password being brute forced we count failed attempts per IP address: five wrong tries locks that address for 24 hours. So a failed attempt writes down an IP address, a counter, and a timestamp, the one place on this site where an IP address is stored at all.

We keep that as tight as we can. The record is deleted the moment a correct password is entered from that address, and anything left over expires automatically after 30 days. It is never linked to your GitHub account. The gate runs before anyone signs in, so there is no identity to attach it to even if we wanted one. One caveat worth knowing on conference Wi-Fi: an IP address can cover a lot of people, so a lockout may not have been caused by you.

Counting where the event reached

We'd like to be able to say which countries the CTF reached. So once per browser session, one number goes up: a tally against a country code, and nothing else. No login, no IP address (not even a hashed or obfuscated one), no timestamp, no session id, nothing that could be traced back to a person or joined against anything else we hold.

The country is worked out by our host from the connection and handed to us already reduced to a two-letter code; we never see or record the address behind it. What we end up with is a list that reads US 412 · DE 88 · JP 40, a rough measure of reach rather than a headcount, and not personal data.

Cookies

Four, all strictly functional, all marked httpOnly so no script on the page can read them. None of them track you, and none follow you off this site.

What other people can see

The leaderboard is public (that's rather the point of a leaderboard), so it's worth being precise about where the line falls. Public:

• Your GitHub login and avatar, your rank, your points, and how many challenges you have patched and not patched.
• Your team, if you're on one. Expanding a team shows every member's login and avatar.
• The total point penalty from hints you've revealed. Which specific hints you bought stays private.
• For some scoring modes, the number of your most recent pull request and a short commit hash.

Not public, and not visible to other contestants or to organizers browsing the site: your email address, your real name, and the contents of any hint you've revealed. Those appear only on your own profile page, behind your own session.

Who else is involved

• GitHub: handles sign-in, hosts the challenge repositories, and serves avatar images. Worth knowing: avatars load straight from GitHub, so GitHub sees the IP of anyone viewing a page with avatars on it, including the leaderboard.
• Vercel: hosts this site, so it processes requests and keeps standard server logs. We also use Vercel Web Analytics, which records which page was viewed. It sets no cookie, and we send it no identifiers, so it cannot tell who you are.
• AWS and Upstash: store the competition data described above. AWS is reached with short-lived credentials rather than stored keys.
• Discord: only ever a link from this site. If you join, Discord's own privacy policy governs what happens there.

Nothing is sold, nothing is used for advertising, and nothing is shared beyond the services above that make the event run. Our stores are backed up as a matter of routine, so a deleted record can persist in a backup for a short period before ageing out.

Your choices, and how to reach a human

• Don't sign in. Everything except your own profile, teams, and hints works signed out.
• Leave your team at any time from your profile. That removes your login from the team record immediately.
• Clear your cookies, or just wait for them to expire, to end the session.

There is no self-serve delete button for competition data, so those requests go to a person. For access, correction, or deletion, contact OWASP at privacy@owasp.com, the address published in the OWASP Privacy Policy, which also sets out the rights available to you, including the additional rights of EEA and California residents. For CTF-specific data such as team membership or hint purchases, email the organizers at defcon-ctf@owasp.org, or ask an organizer in the CTF Discord if you want it dealt with faster. You never have to join Discord to exercise a right over your own data. One honest caveat: removing your scores from the leaderboard means withdrawing from the competition.