A CTF rules template is a ready-made rulebook you adapt for your own capture the flag event. A complete one covers eligibility, team size, flag sharing, scoring and tie-breaks, hints, what's in scope, AI tools, prizes and winner verification, writeup embargo, privacy, and how disputes are handled. Copy the template below, fill in the placeholders and publish it with registration.
Key takeaways
- Rules prevent disputes. Most CTF arguments, from tied scores to prize eligibility, come from something the rules didn't say.
- Rules, code of conduct and platform terms are different documents. Rules cover how the competition works. A code of conduct covers how people behave.
- Every CTF needs an AI clause. Pick one: open, co-pilot only, capped, split scoreboards, or banned with validation. Silence is the worst option.
- A policy is only as good as its checks. Plan writeup reviews or short verification calls for prize winners before the event, not after.
Why your CTF needs written rules
Rules are the agreement between you and every player. They decide what happens when two teams finish on the same score, when a flag turns up in a public chat, or when the winning team turns out to be ineligible for the prize. If those answers are written down before the event, you apply them. If they aren't, you make them up under pressure, with players watching.
Good rules also do three quieter jobs:
- They define scope. A CTF is legal practice because players attack only what the organizer has authorized. The rules draw that line, especially around your scoring platform and other players.
- They protect sponsors and your institution. Prize eligibility, age limits and data handling are what a college administration, company legal team or sponsor will ask about first.
- They help with listing. Public CTF calendars expect clear rules, dates and a published scoreboard. Our guide on how to list your CTF on CTFtime covers the details.
Rules vs code of conduct vs platform terms
| Document | What it covers | Who writes it |
|---|---|---|
| Event rules (this template) | Eligibility, teams, scoring, hints, AI tools, prizes, embargo, appeals | You, for each event |
| Code of conduct | Respect, harassment, how to report problems, enforcement | Usually reused across events. Adapt the CTF7 Code of Conduct |
| Platform terms | Accounts and acceptable use of the platform itself | The platform, such as the CTF7 Terms of Service |
If you're still planning the event, our guide to hosting a CTF shows where rules fit in a 12-week timeline. This page goes deeper on the rules themselves.
Copy-ready CTF rules template
Replace everything in {curly braces} and delete lines that don't apply. Section 8 is left blank on purpose: paste one of the AI policy options below into it. Prefer a file? Download the template as Markdown (rules and all five AI options in one file).
# {Event name} {Year}: Official Rules
Version {1.0} · Last updated {DD Month YYYY}
Organizer: {Organizer, club or company} · Rules contact: {email}
Platform: {Platform name and event URL}
By registering, you agree to these rules, the event Code of Conduct ({link})
and the platform's terms of service.
## 1. Event details
- Format: {Jeopardy / attack-defense / King of the Hill / mixed}, {online / on-site at venue}.
- Dates: {start date and time} to {end date and time} ({time zone, e.g. IST, UTC+5:30}).
- Divisions: {Open / Student / Beginner / Corporate}.
- Flag format: {CTF7{...}} unless a challenge says otherwise.
## 2. Eligibility
- Open to {everyone / students currently enrolled at a college or school / employees of invited organizations}.
- Players must be at least {18} years old. Players aged {13 to 17} need written consent
from a parent or guardian {and are not eligible for cash prizes}.
- Organizers, challenge authors, and anyone with early access to challenges
{may not play / may play unranked, without prizes}.
- Prizes are limited to players in {countries or regions}. Eligibility is verified
before prizes are awarded (Section 10).
- We may refuse or cancel a registration that is incomplete, duplicated or false.
## 3. Teams and accounts
- Teams have {1} to {4} members. Rosters lock at {date and time}.
- One account per person and one team per person. Do not share accounts.
- Collaborate only within your registered team. In solo divisions, all work must be your own.
- Team names must follow the Code of Conduct. We may rename or remove offensive names.
## 4. Fair play and flag sharing
- Do not share flags, solutions, hints or partial progress with anyone outside your team
until the event ends.
- Asking for, buying or receiving flags counts as sharing. Both teams are penalized.
- Do not use multiple accounts or play on behalf of another team.
- Only submit flags for challenges your team solved during the event.
Flags or writeups from earlier editions don't count.
- {Optional: Flags are unique per team. Submitting another team's flag is treated
as evidence of sharing.}
## 5. Scoring and tie-breaks
- Scoring: {Static: each challenge has a fixed point value. / Dynamic: each challenge
starts at {500} points and decreases to a minimum of {100} as more teams solve it.
All teams' scores update, including teams that solved it earlier.}
- Wrong submissions: {carry no penalty / are rate-limited to {10} attempts per minute per challenge}.
- Tie-break: teams with equal points are ranked by the earliest time of their last
score-increasing submission. {Alternative: fewer wrong submissions first,
then earliest last submission.}
- The scoreboard {freezes at {time} / stays live until the end}. Final standings are
published after verification on {date}.
- If a challenge is broken, we may fix it, remove it or adjust scores for affected teams.
Every adjustment is announced to all teams.
## 6. Hints
- Hints are {free / cost {X} points / cost {X}% of the challenge value}. The cost is deducted
when you unlock a hint, whether or not you solve the challenge.
- Organizers don't give individual solving help. Ask questions only in {support channel}.
Answers that help everyone are posted publicly.
## 7. Scope and infrastructure
- Only the targets listed in each challenge are in scope.
- Do not attack, scan or overload the scoring platform, registration system, flag submission
system, hosting infrastructure, other players or any third party.
- No denial-of-service. No automated brute force of flags or logins. Automated tools may be
used against a challenge only if that challenge says so.
- Report platform bugs and unintended solutions to {contact}. Do not exploit them.
{Helpful reports may earn recognition.}
- {Attack-defense only: Attacking other teams' services through the game network is part
of the game. Attacking the game infrastructure, the checker or anything outside the
game network is not.}
## 8. AI tools
{Paste ONE AI policy option (A, B, C, D or E) here.}
## 9. Writeups and embargo
- Do not publish writeups, solutions or challenge files until {the event ends / {date and time}}.
- {If challenges will be reused: Please don't publish writeups for {named challenges}.
We'll list them at the end of the event.}
- After the embargo, writeups are welcome. Share them at {hashtag, page or channel}.
- Challenge files and source code remain the property of {owner} {and are released under {license}}.
## 10. Prizes and verification
- Prizes: {1st: ... / 2nd: ... / 3rd: ... / Special: best writeup, best beginner team}.
- Before prizes are confirmed, the top {N} teams must {submit writeups within {48} hours /
join a short verification call to explain their solutions}.
- Winners must provide {ID proof, student ID, payment or shipping details} within {14} days.
Prizes unclaimed after {30} days are forfeited {or passed to the next eligible team}.
- Cash prizes are paid {to the team captain / split equally among members} and may be
subject to applicable taxes.
- Prizes can't be transferred or exchanged unless the organizers agree.
## 11. Privacy
- We collect {name, email, institution, team name, country} to run the event,
verify eligibility and deliver prizes.
- The public scoreboard shows {team name and country / username only}.
- Event data is processed by {platform} under its privacy policy ({link}). We keep personal
data for {X months} after the event, then delete it, except records we must keep
for prizes or tax.
- {If sponsors or recruiters are involved: With your consent, we share results with
{sponsors or hiring partners}. You can opt out at registration.}
- To access or delete your data, contact {email}.
## 12. Penalties, disputes and appeals
- Breaking these rules can lead to a warning, point deduction, removal of a solve,
loss of prize eligibility, disqualification or a ban from future events.
- Decisions are based on evidence such as platform logs, submission records and flag data.
A shared IP address alone is not treated as proof of cheating.
- To dispute a decision or score, email {contact} within {48 hours} of the results with
your team name and reason. Someone not involved in the original decision reviews
the logs and replies within {X} days.
- The organizer's decision after review is final.
## 13. Changes to these rules
- We may update these rules to fix errors or respond to issues during the event.
Every change is announced in {channel} and reflected in the version line above.A template, not legal advice. If your event offers cash prizes, admits minors or accepts players from several countries, ask your institution's or company's legal or finance team to review the final text.
Publish these rules on your CTF7 event. CTF7 events support custom pages and announcements, so your rules, code of conduct and updates sit next to registration and the scoreboard. Tell us about your event or compare plans on the pricing page.
How to fill in the key clauses
Most sections need only a few values. These are the decisions that cause trouble when they're left vague.
Eligibility, age and staff
Decide who can win, not just who can play. Many events let anyone play but limit prizes to a country, a student status or an age group. If you admit school students, ask for guardian consent and say whether minors can receive cash prizes. Our guide to CTFs for high school students covers the planning side. Organizers and challenge authors should never compete for prizes in their own event.
Team size and divisions
Teams of 1 to 4 are typical for college events, while open international CTFs often allow larger or unlimited teams. Solo divisions suit hiring CTFs and classroom assessments, where you want an individual result. Separate Student or Beginner boards give newer players something to win.
Scoring and tie-breaks
State the scoring model in one sentence and the tie-break in another. With dynamic scoring, players must know that earlier solves lose value too. Two tie-break rules are common:
| Tie-break rule | How it works | Best for |
|---|---|---|
| Earliest last solve | Teams on equal points are ranked by who reached that score first | Most events; easy to explain |
| Accuracy, then time | Points first, then fewer wrong submissions, then the time of the last correct submission | Events where flag guessing is a concern |
"Earliest last solve" is the simplest and the most widely understood. "Accuracy, then time" discourages flag guessing. For decay formulas and worked examples, see our guide to CTF scoring, and fix your flag format early so you can state it in Section 1.
Writeup embargo
The usual embargo runs until the event ends. Extend it only if you plan to reuse challenges. If you plan to reuse challenges, ask players not to publish writeups for those specific ones. Once the embargo lifts, actively ask for writeups. They're the best record of your event, and our guide on how to write a CTF writeup is a useful link to share with players.
Format-specific additions
- Attack-defense: say which network is in scope, whether you can patch your own vulnbox, and that breaking the checker is off-limits. Our checker SLA glossary entry explains why. See the attack-defense CTF format page for more.
- King of the Hill: define what counts as holding the machine, and ban changes that make it permanently unusable for everyone else.
- Report-based events (Raw Ops): publish the scope, report format and duplicate policy. Point players to our vulnerability report template.
- Hackathons: add originality and reuse rules for code and assets, as in Section 4 of the code of conduct.
AI-usage policy options for CTFs
Players have access to AI assistants that can explain a cipher, read a decompiled function or draft a script in seconds, so "can you use AI in a CTF?" is now one of the first questions players ask. There's no single right answer. What matters is that you choose one of these five options, define it precisely and publish it before registration closes.
| Option | Pros | Cons | Best for | |
|---|---|---|---|---|
| A · Open | Any AI use is allowed. Disclosure encouraged | Honest about how people work today. Nothing to police | Scoreboard partly measures tool use. Easy challenges lose value | Practice rounds, internal training, AI-security themed events |
| B · Co-pilot only (hybrid) | Chat assistants allowed. Autonomous agents and automated submission banned | Mirrors many workplaces. AI helps, but people still solve the challenges | The line between co-pilot and agent can blur | Most college, community and open online CTFs |
| C · Capped | AI allowed within limits on spend, hardware or tool type | Levels the field across budgets | Hard to verify. Relies on honesty | Student leagues, multi-school events |
| D · Split scoreboards | Players choose AI-allowed or AI-prohibited at registration | Both groups compete fairly. The gap is visible | Two prize tables, more admin, honesty-dependent | Prize-heavy open events |
| E · Banned + validation | No AI use. Winners prove their solves | Clearest skill signal. Fair to players without paid tools | Enforcement needs interviews or supervision | Hiring rounds, finals, on-site contests, graded coursework |
Paste one of these clauses into Section 8 of the template. Each one is written to be specific enough to enforce.
## Option A: AI open
You may use any AI tools, including chat assistants, coding assistants and agents you run
yourself. Every other rule still applies. AI tools must not scan, overload or automate
against the scoring platform, and you are responsible for everything your tools do.
Sharing flags or solutions through a shared AI workspace, prompt collection or public
chat counts as flag sharing.
## Option B: Co-pilot only (assistants yes, autonomous agents no)
You may use AI assistants as helpers: to explain concepts, summarize documentation, or
review and write code that you read and run yourself. You may not use autonomous agents
that interact with challenge targets, operate the platform or submit flags without a
person directing each step. The top {N} teams may be asked to explain their solutions
in a short call.
## Option C: AI capped
You may use AI assistants within these limits: {publicly available tools only; no paid
plans above {amount} per month; no self-hosted models above {size}}. Autonomous agents
may not interact with challenge targets or the platform. Teams that exceed the limits may
lose affected solves. The top {N} teams may be asked to explain their solutions in a
short call.
## Option D: Separate scoreboards
At registration, each team chooses the AI-Permitted or AI-Prohibited scoreboard. The choice
is final once the event starts. AI-Permitted teams follow Option {A / B / C}. AI-Prohibited
teams follow Option E. Each scoreboard has its own prizes: {prize split}. Prize winners on
the AI-Prohibited scoreboard must complete a verification {call / writeup review}.
## Option E: AI banned, with validation
AI tools may not be used to solve challenges during the event. This includes chat
assistants, code completion, AI features inside other software, and agents.
{Allowed exceptions: spell-check, translating challenge text, accessibility tools.}
Prize-eligible teams must {submit writeups / join a verification call}. If a team
can't explain a solution, that solve may be removed.
Whichever option you choose, define three things: which tools count as AI (including AI features built into editors and other software), whether agents may touch challenge targets or the platform, and how you'll check prize winners. For the wider debate on whether to allow AI at all, read should your CTF allow AI?
What other events do
Published AI policies range from fully open to fully banned, with co-pilot-only rules and separate scoreboards in between. Read the rules pages of two or three events your players already enter before you choose; the useful thing to copy is not the policy but how precisely it is worded. Whichever policy you pick, enforcement in practice means verifying winners afterwards, through a writeup or a short call, because AI use cannot be reliably detected from submissions alone.
Making your rules and AI policy enforceable
A flag submission doesn't show how the flag was found. Enforcement therefore comes from verification, challenge design and good logs, not from detection alone.
- Verify winners. Ask the top teams for writeups within 48 hours, or hold a 15-minute call where they walk through two solves. Announce this in the rules so nobody is surprised.
- Make sharing traceable. Dynamic flags make a copied flag point back to the team it was issued to. Our explainer on dynamic flags and anti-cheat covers rate limits, honeypot flags and a graded penalty scale.
- Design with AI in mind. On-site rounds, multi-part challenges and challenges that need interaction with event-specific infrastructure are harder to hand off to a tool.
- Playtest against AI. During testing, try each challenge with public AI assistants and decide whether the result matches your policy. If an easy challenge falls in seconds, that may be fine for an Allowed event and a problem for a Not allowed one. See how to create CTF challenges for the full testing process.
- Keep logs for the appeal window. Your dispute clause promises a review of the evidence, so keep submission and access logs until appeals close.
Your AI policy lives in your published rules and doesn't depend on any particular platform feature. If you host on CTF7, the Standard plan includes dynamic flags and anti-cheat monitoring with IP and browser tracking, alerts and submission logs, which helps with flag sharing whichever AI option you pick. Compare plans on the pricing page.
Publishing your rules: a checklist
- Publish the rules with registration, about eight weeks before the event, and require players to accept them at sign-up.
- Put a version number and date at the top, and announce every change publicly.
- Pin the rules and the code of conduct in your event chat and announcements channel.
- Name one rules contact and a separate reviewer for appeals.
- State the AI policy in the event description too, since players look for it before they register.
- Freeze the rules when the event starts. Change them mid-event only to fix a genuine error.
Running a college or club event? Pair this page with our guide to running a college CTF in India, or tell us about your event and we'll help you plan it.
