RULES OF ENGAGEMENT
Official rules, security regulations, and operational code of conduct for SecLeaf Q4 CTF 2026. Every participant and team must adhere strictly to these rules.
Respect the Competition
Maintain professional conduct and good sportsmanship at all times during the event.
Cheating, flag sharing, exploiting unintended vulnerabilities, attacking CTF infrastructure, or suspecting AI usage will result in immediate disqualification and termination without warning.
Team Operation
This is a TEAM event. Team members must collaborate strictly within their registered team.
Sharing solutions, hints, or flags with other teams is strictly prohibited.
Teams are fully responsible for all actions taken from their accounts. Any attempt to disrupt other teams or infrastructure will result in immediate disqualification.
Challenge Integrity
All challenges are created for educational and competitive purposes. Difficulty ranges from beginner to expert level.
Solve challenges using your own analytical and technical skills.
Flag Acquisition
Flags must be obtained by solving the intended challenge mechanism.
All flags follow the standard format: SecLeaf{your_flag_here}
Flags are case-sensitive unless explicitly stated otherwise in challenge notes.
Infrastructure Protection
Do NOT attempt to attack or disrupt the CTF platform infrastructure. No DoS, DDoS, network flooding, or automated brute-forcing.
Only interact with target systems and ports explicitly provided in challenge scope.
Tools & Automation
Legal security tools (e.g., Nmap, Burp Suite, Wireshark, Ghidra) are allowed unless restricted in a specific challenge.
Automated scripts designed to brute-force flag submissions on the platform are strictly prohibited.
Submission Policy
Submit flags exactly as provided.
Extra spaces, incorrect casing, or modified flag wrappers will be rejected by the scoring engine.
Hints & Assistance
Official hints may be released for certain challenges. Use hints responsibly to enhance your learning.
Requesting hints, solutions, or flags from other competitors is strictly forbidden.
Disputes & Final Authority
Any disputes or unexpected platform issues must be reported immediately to organizers via official support channels.
All organizer decisions regarding scoring, rules, and disqualifications are final and binding.
Suspecting unauthorized AI usage or competition tampering will result in immediate termination without warning.
AI USAGE POLICY
Artificial Intelligence is a tool. Not a substitute for skill.
- • Understanding cybersecurity concepts & fundamentals
- • Learning exploitation techniques & theoretical frameworks
- • Explaining error messages or compiler outputs
- • Syntax assistance, regex debugging & code formatting
- • General documentation reading & technical research
- • Suspecting AI usage or automated solving will result in immediate termination without warning
- • Feeding entire challenge descriptions/files to AI for direct solutions
- • Using AI to auto-generate exploit payloads without comprehension
- • Deploying autonomous AI agents or automated solving pipelines
- • Real-time collaboration with non-teammates via shared AI prompts
You are here to test your mind, not outsource it. Suspecting AI usage will result in immediate account termination and team disqualification without prior warning. Organizers reserve full authority to demand live code walkthroughs, technical explanations, or immediate termination.
OPERATIONAL WINDOW
The clock is absolute.
The competition begins strictly on 31st October 2026 at 14:00 IST and runs through 1st November 2026. No late submissions, no time extensions, no exceptions. Plan your operation around the active countdown.
WINNER VERIFICATION
The top teams must prove their skill.
The TOP 10 TEAMS MUST submit detailed technical writeups explaining their methodologies within 24 HOURS of competition conclusion. Organizers reserve absolute right to review, question, or reject submissions. Suspecting unauthorized AI automation or foul play will result in immediate disqualification and termination without warning.
Failure to submit writeups within 24 hours will result in forfeiture of rank and prizes, shifting rewards automatically to the next eligible team on the leaderboard.