Skip to content

Flagpost v1.0.0 — Initial public release

Choose a tag to compare

View all tags
@tbcsec tbcsec released this 25 Jul 14:39
· 127 commits to main since this release
v1.0.0
7704458

The first public release of Flagpost — a modern, open-source CTF competition management platform. Everything below is built, wired, and shipping.

🎯 Run a competition

  • Competitions in individual or team mode — with visibility control, scheduling, pause, archive, and one-click cloning.
  • Teams with invite codes, optional captain approval, size caps, and profiles.
  • Challenges with rich descriptions, categories, per-competition tag & difficulty vocabularies, hints, scheduled/waved release, and prerequisite unlock chains.
  • Flag types: static, regex, multiple-choice (with a guess cap), and dynamic decay scoring.
  • Bulk challenge import/export in ctfcli YAML format.

🏆 Scoreboard & scoring

  • Live scoreboard over WebSocket, with first-blood markers and per-challenge solver lists.
  • Scoreboard freeze, brackets / divisions, a public / spectator board, and a CTFtime feed.

⚡ Realtime & collaboration

  • Live announcements, an in-app notification center with per-user preferences, and presence ("who's viewing this").
  • Collaborative CRDT notes — a team scratchpad per challenge, and staff notes on tickets.

🎫 Support, feedback & analytics

  • Support tickets with staff assignment, internal notes, and a live queue.
  • Surveys and post-solve challenge ratings.
  • Challenge & team analytics.

🤖 Automation

  • An event-driven automation engine with a visual rule builder (When → If → Then).
  • Actions including notifications, announcements, point-bearing awards, hint release, challenge unlock, score adjustment, scoreboard freeze, and egress-hardened webhooks & email.

🛠️ Operate & administer

  • Role-based access control with a custom role editor.
  • A customizable operational dashboard (drag-and-drop widgets).
  • Site theming + custom branding (palettes, accent, org logo), user administration, and full platform export / import backups.
  • First-run setup wizard — no default admin, no hard-coded credentials.

🚀 Deploy

  • A single-origin Docker production stack (docker compose up), plus a documented demo mode.

🔒 Security

Hardened for public use: ReDoS-contained flag matching, a per-install JWT secret, SSRF-hardened webhook egress, CSP + security headers, argon2 password hashing, and stateful refresh sessions. Report vulnerabilities via SECURITY.md — never a public issue.

License: GNU AGPL-3.0 · Docs: README and docs/ · Contributing: CONTRIBUTING.md

Assets 2
Loading