Secure Development · Quiz · Jeopardy
Nov 5, 2026 · OWASP Global AppSec USA 2026 · San Francisco
Break real vulnerabilities in 1 deliberately vulnerable training app, patch them for real, and ship the fix as a GitHub pull request. CI validates your patch and scores it automatically. Practice the full secure development lifecycle, not just flag-hunting.
9 challenges · 1 app
Browse targetsAnswer security questions for points. Every question carries its own point value, is graded the moment you submit it, and counts toward your place on the leaderboard.
15 questions
Take the quizFind each flag and submit it for points. Every flag carries its own point value, grading happens the instant you submit, and matching ignores leading or trailing whitespace and — unless a flag is marked case-sensitive on its card — capitalisation too.
26 flags
Browse the flagsBring your agent
This isn’t tolerated, it’s the point. Reviewing code, finding the flaw, and writing the patch with an AI agent is the skill this event exists to build. Bring whatever you already use (Claude Code, Copilot, Cursor, your own harness) and let it read the target.
OWASP’s own open-source playbook for pointing an AI agent at a codebase. It ships structured, OWASP-grounded procedures for security code review, dependency and secrets scanning, and API and web assessment, each one mapped to the same OWASP Top 10 categories these challenges are graded against. It turns “find the bug” into a repeatable method, which is exactly what you want against 300-plus challenges on a deadline.
1 real target
Each app is a well-known, deliberately vulnerable open-source project. Points scale with difficulty, and the deeper flaws in VAmPI pay out the most.
This event runs on OWASP CTF in a Box: one machine, one free GitHub org, no cloud account, scoring rubrics included. A university course, a chapter night or a weekend workshop can stand it up in an afternoon.