# CTF Rules Template (with AI-usage policy options) Free template from CTF7 (https://ctf7.com/learn/ctf-rules-template/). Use it, edit it and publish it for your own event. No attribution required. How to use it: 1. Replace everything in {curly braces}. Delete the lines that don't apply to your event. 2. In Section 8, paste ONE of the AI policy options from the end of this file. 3. Publish the rules with registration, ask every player to accept them, and pin them in your event channels. 4. Pair the rules with a code of conduct for behavior (harassment, reporting). You can adapt https://ctf7.com/code-of-conduct/. This template is a starting point, not legal advice. If your event has cash prizes, minors or international players, ask your institution's or company's legal or finance team to review it. --- # {Event name} {Year}: Official Rules Version {1.0} · Last updated {DD Month YYYY} Organizer: {Organizer, club or company} · Rules contact: {email} Platform: {Platform name and event URL} By registering, you agree to these rules, the event Code of Conduct ({link}) and the platform's terms of service. ## 1. Event details - Format: {Jeopardy / attack-defense / king of the hill / mixed}, {online / on-site at venue}. - Dates: {start date and time} to {end date and time} ({time zone, e.g. IST, UTC+5:30}). - Divisions: {Open / Student / Beginner / Corporate}. - Flag format: {CTF7{...}} unless a challenge says otherwise. ## 2. Eligibility - Open to {everyone / students currently enrolled at a college or school / employees of invited organizations}. - Players must be at least {18} years old. Players aged {13 to 17} need written consent from a parent or guardian {and are not eligible for cash prizes}. - Organizers, challenge authors, and anyone with early access to challenges {may not play / may play unranked, without prizes}. - Prizes are limited to players in {countries or regions}. Eligibility is verified before prizes are awarded (Section 10). - We may refuse or cancel a registration that is incomplete, duplicated or false. ## 3. Teams and accounts - Teams have {1} to {4} members. Rosters lock at {date and time}. - One account per person and one team per person. Do not share accounts. - Collaborate only within your registered team. In solo divisions, all work must be your own. - Team names must follow the Code of Conduct. We may rename or remove offensive names. ## 4. Fair play and flag sharing - Do not share flags, solutions, hints or partial progress with anyone outside your team until the event ends. - Asking for, buying or receiving flags counts as sharing. Both teams are penalized. - Do not use multiple accounts or play on behalf of another team. - Only submit flags for challenges your team solved during the event. Flags or writeups from earlier editions don't count. - {Optional: Flags are unique per team. Submitting another team's flag is treated as evidence of sharing.} ## 5. Scoring and tie-breaks - Scoring: {Static: each challenge has a fixed point value. / Dynamic: each challenge starts at {500} points and decreases to a minimum of {100} as more teams solve it. All teams' scores update, including teams that solved it earlier.} - Wrong submissions: {carry no penalty / are rate-limited to {10} attempts per minute per challenge}. - Tie-break: teams with equal points are ranked by the earliest time of their last score-increasing submission. {Alternative: fewer wrong submissions first, then earliest last submission.} - The scoreboard {freezes at {time} / stays live until the end}. Final standings are published after verification on {date}. - If a challenge is broken, we may fix it, remove it or adjust scores for affected teams. Every adjustment is announced to all teams. ## 6. Hints - Hints are {free / cost {X} points / cost {X}% of the challenge value}. The cost is deducted when you unlock a hint, whether or not you solve the challenge. - Organizers don't give individual solving help. Ask questions only in {support channel}. Answers that help everyone are posted publicly. ## 7. Scope and infrastructure - Only the targets listed in each challenge are in scope. - Do not attack, scan or overload the scoring platform, registration system, flag submission system, hosting infrastructure, other players or any third party. - No denial-of-service. No automated brute force of flags or logins. Automated tools may be used against a challenge only if that challenge says so. - Report platform bugs and unintended solutions to {contact}. Do not exploit them. {Helpful reports may earn recognition.} - {Attack-defense only: Attacking other teams' services through the game network is part of the game. Attacking the game infrastructure, the checker or anything outside the game network is not.} ## 8. AI tools {Paste ONE AI policy option (A, B, C, D or E) here.} ## 9. Writeups and embargo - Do not publish writeups, solutions or challenge files until {the event ends / {date and time}}. - {If challenges will be reused: Please don't publish writeups for {named challenges}. We'll list them at the end of the event.} - After the embargo, writeups are welcome. Share them at {hashtag, page or channel}. - Challenge files and source code remain the property of {owner} {and are released under {license}}. ## 10. Prizes and verification - Prizes: {1st: ... / 2nd: ... / 3rd: ... / Special: best writeup, best beginner team}. - Before prizes are confirmed, the top {N} teams must {submit writeups within {48} hours / join a short verification call to explain their solutions}. - Winners must provide {ID proof, student ID, payment or shipping details} within {14} days. Prizes unclaimed after {30} days are forfeited {or passed to the next eligible team}. - Cash prizes are paid {to the team captain / split equally among members} and may be subject to applicable taxes. - Prizes can't be transferred or exchanged unless the organizers agree. ## 11. Privacy - We collect {name, email, institution, team name, country} to run the event, verify eligibility and deliver prizes. - The public scoreboard shows {team name and country / username only}. - Event data is processed by {platform} under its privacy policy ({link}). We keep personal data for {X months} after the event, then delete it, except records we must keep for prizes or tax. - {If sponsors or recruiters are involved: With your consent, we share results with {sponsors or hiring partners}. You can opt out at registration.} - To access or delete your data, contact {email}. ## 12. Penalties, disputes and appeals - Breaking these rules can lead to a warning, point deduction, removal of a solve, loss of prize eligibility, disqualification or a ban from future events. - Decisions are based on evidence such as platform logs, submission records and flag data. A shared IP address alone is not treated as proof of cheating. - To dispute a decision or score, email {contact} within {48 hours} of the results with your team name and reason. Someone not involved in the original decision reviews the logs and replies within {X} days. - The organizer's decision after review is final. ## 13. Changes to these rules - We may update these rules to fix errors or respond to issues during the event. Every change is announced in {channel} and reflected in the version line above. --- # AI policy options (paste one into Section 8) ## Option A: AI open You may use any AI tools, including chat assistants, coding assistants and agents you run yourself. Every other rule still applies. AI tools must not scan, overload or automate against the scoring platform, and you are responsible for everything your tools do. Sharing flags or solutions through a shared AI workspace, prompt collection or public chat counts as flag sharing. ## Option B: Co-pilot only (assistants yes, autonomous agents no) You may use AI assistants as helpers: to explain concepts, summarize documentation, or review and write code that you read and run yourself. You may not use autonomous agents that interact with challenge targets, operate the platform or submit flags without a person directing each step. The top {N} teams may be asked to explain their solutions in a short call. ## Option C: AI capped You may use AI assistants within these limits: {publicly available tools only; no paid plans above {amount} per month; no self-hosted models above {size}}. Autonomous agents may not interact with challenge targets or the platform. Teams that exceed the limits may lose affected solves. The top {N} teams may be asked to explain their solutions in a short call. ## Option D: Separate scoreboards At registration, each team chooses the AI-Permitted or AI-Prohibited scoreboard. The choice is final once the event starts. AI-Permitted teams follow Option {A / B / C}. AI-Prohibited teams follow Option E. Each scoreboard has its own prizes: {prize split}. Prize winners on the AI-Prohibited scoreboard must complete a verification {call / writeup review}. ## Option E: AI banned, with validation AI tools may not be used to solve challenges during the event. This includes chat assistants, code completion, AI features inside other software, and agents. {Allowed exceptions: spell-check, translating challenge text, accessibility tools.} Prize-eligible teams must {submit writeups / join a verification call}. If a team can't explain a solution, that solve may be removed.