No monetary bounty at this time. CTF7 does not currently pay rewards for reports. We do read every one, and we will thank you if you want to be named once an issue is fixed.
How to report
For a security vulnerability, email [email protected] rather than using the public form, so details stay private. For any other bug, use the form below or email [email protected]. Machine-readable contact details are in our security.txt. How we protect the platform is described on the security page.
Scope
In scope
- ctf7.com and the CTF7 website, including accounts, registration, payments and the organizer dashboard.
- Event sites hosted on subdomains of ctf7.com (*.ctf7.com).
- The CTF7 mobile app and the API it uses.
Out of scope
- Challenges and targets written by event organizers. They are meant to be attacked, but only inside the rules of the event; a flaw in a challenge is not a platform vulnerability.
- Social engineering of CTF7 staff, organizers or participants, including phishing.
- Physical attacks on offices, devices or data centers.
- Denial of service, load testing and other volumetric attacks.
- Third-party services we use, such as the payment gateway, email delivery and hosting providers. Report those to the vendor.
What to report
Use this page for problems with the CTF7 platform itself, for example the website, accounts, registration and payments, the scoreboard or the organizer dashboard. Issues with an individual challenge during a live event (a broken challenge instance, a flag that won't validate) are usually fastest to resolve through that event's organizers or announcement channel.
What to include in your report
A clear report helps the team reproduce and fix the issue quickly:
- The page URL or feature where the issue occurs.
- Step-by-step instructions to reproduce it.
- What you expected to happen and what actually happened.
- Screenshots, request/response samples or error messages, if available.
- Your browser and device, and the time you observed the issue.
- Your contact email, so the team can follow up with questions.
Good-faith safe harbor
If you act in good faith and follow this policy, we will not pursue legal action against you for your research. In practice, good faith means:
- Do not access, change or delete data that belongs to other people. Test with your own account where you can.
- If you come across personal data, stop, do not copy or share it, and tell us.
- Do not disrupt the service for other users or interfere with a live event.
- Give us a reasonable time to fix the issue before you disclose it publicly, and tell us if you plan to publish.
This safe harbor covers CTF7's own systems. It cannot authorize testing of third-party services, which have their own rules.
What happens after you report
We acknowledge reports and keep you updated until the issue is resolved. We may ask you for more detail, and we will tell you when it is fixed.
Please keep in mind that use of the platform remains subject to our Terms of Service and Code of Conduct, and that personal data you share is handled under our Privacy Policy.