Security: Accounts, Events, Payments and Data

Accounts

Email verification for accounts created with an email and password.
Passkeys and security keys (WebAuthn), usable to sign in as well as to confirm a second factor.
Authenticator apps (TOTP) and recovery codes as additional second factors.
Sign in with Google, GitHub or Apple, so you can skip a CTF7 password altogether. We do not receive your password for those providers.
Two-factor authentication is required for CTF7 staff. A staff account that loses its second factor is deactivated by a scheduled check.
Support PIN. You can generate a short PIN in your account settings. Support and staff roles must be given a valid PIN by you before they can act as your account, and the PIN expires and has a limited number of uses.

Per-team dynamic flags. Where an organizer enables them, each team gets its own flag for a challenge, so a flag shared between teams can be told apart from a solve.
Flag-submit throttling. Flag submissions are rate limited per team and per challenge to slow down brute-force guessing.
Anti-cheat forensics. Detection modules flag suspicious patterns for organizers to review as incidents, alongside page-view and download tracking.
Audit logging. Changes made by organizers and staff are recorded in an audit log that CTF7 staff review internally.

See the features page for how organizers use these during an event.

Paid events use Razorpay's hosted checkout. CTF7 never sees or stores your card, bank account or UPI details. We keep the order and payment identifiers, amount and status.
Payment confirmations from Razorpay are signature-verified before we act on them.
A reconciliation job compares Razorpay's ledger with our records so a captured payment is not lost if a confirmation fails to arrive.

Encrypted at rest where it matters most. Container registry credentials used for challenge deployments, and organizer bank account details used for payouts, are stored encrypted.
CTF7 websites are served over HTTPS.
The processors that handle your data, what each receives, and the fact that some may process data outside India are listed in our privacy policy.
Candidates in the hiring system are visible to organizers only if they turn on "open to work", and contact details are not shared from the directory. See hiring through CTF7.
CTF7 holds no third-party security certification, such as ISO 27001 or SOC 2, and does not claim one. This page describes what the platform does instead.

If you find a security issue, email [email protected]. Scope, safe harbor for good-faith research and what to include are on the report a bug or security issue page, and our security.txt has the same contact details for tools.