RULES & GUIDELINES

01 COMPETITION FORMAT

STARPWN is a jeopardy-style Capture The Flag (CTF) competition. Participants compete individually or in teams to solve challenges across multiple categories, earning points for each correct flag submission.

Our primary method of communication will be Discord. All updates and communication regarding the competition will happen there, and that's also where you can reach out to the organizers if needed.

Make sure to read and understand our AI/LLM/Agent policy below

02 TEAM RULES

• There are no limits on team size. If you intend to participate alone, create a solo team.
• Each participant may only be a member of one team.
• Team names must not be offensive or inappropriate.
• Sharing flags or solutions between teams is strictly prohibited.

03 FLAG SUBMISSION

• Flags follow the format STARPWN{.*} (only printable ASCII characters) unless stated otherwise in the challenge description.
• Flag submissions are case-sensitive. Submit exactly as captured.
• No flag-hoarding. If you find a flag it should be submitted right away, this is to ensure a level playing field for all teams at each step of the way.

04 SCORING

• Most challenges use dynamic scoring where points decrease as more teams solve them.
• When a challenge has a static score for some reason, that is noted on the description.
• Every team receives the same amount of points for a challenge, regardless of the solve time.
• The team with the highest total points at the end of the competition wins.
• In the event of a tie, the team that reached the point total first will be ranked higher.

05 PROHIBITED ACTIONS

• Do not attack the competition infrastructure (CTFd platform, scoring servers, or other supporting systems).
• Do not attack other participants or their systems.
• Do not brute-force flag submission endpoints.
• Do not share flags, hints, or solutions publicly during the competition.
• Do not use automated tools to spam or degrade platform performance.
• Do not create multiple accounts or teams to gain an unfair advantage.

06 DISPUTES & SUPPORT

• For technical issues or questions, reach out via the official Discord channel.
• Challenge disputes must be submitted before the competition ends and will be reviewed by the organizers.
• The organizers reserve the right to modify rules or disqualify participants in cases of severe violations.

07 CODE OF CONDUCT

All participants are expected to maintain a respectful and inclusive environment. Harassment, discrimination, or any form of abusive behavior will not be tolerated and may result in immediate disqualification.

08 AI/LLM/Agent policy

We believe that CTFs should primarily be a playground for humans to challenge themselves, learn new things, and have fun with the CTF community. And in line with that, we don't believe that solving a challenge by letting an LLM do most of the work aligns with that philosophy. With that said, we must recognize that AI, LLMs and agents can be useful tools, are more relevant than ever, and their usage is virtually impossible for us to control in a reliable and fair way.

With this in mind, we decided on a few ground rules:

• Fully or primarily autonomous teams are not allowed and will result in disqualification. While humans are free to use any tools they wish, we believe just answering "yes/no" to an agent prompt reverts the roles between humans/tools.
• We reserve the right to, at any time during the CTF, ask teams to get in touch with the organizers and talk us through their solutions.
• The top 3 teams will be asked to submit short writeups for a selection of challenges. These won't have to be polished documents but should at least provide a good description of your reasoning and how you've arrived at the answer. Relevant teams will be notified when approaching the end of the competition.

These rules are intended to reflect the values of the CTF community, and preserve the fun and environment that CTF challenges provide for both players and authors. This policy was not created in a vacuum and we must thank the previous efforts by the organizers of Kalmar CTF, RITSEC CTF, DEFCON CTF, amongst others, for their exploration of AI policies in CTFs.

01 PROTOCOL INITIALIZATION

STARPWN is a jeopardy‑style assault on Glittergrid's corpo world. Operator cells (individual or team) penetrate target nodes across multiple domains, exfiltrating authentication tokens (flags) for each compromised asset.

Primary command & control channel: Discord — all SIGINT broadcasts, tactical updates, and support requests route through this nexus.

All operators must acknowledge the Augmented Cognition Framework outlined in protocol 08 before engaging.

02 CELL STRUCTURE DIRECTIVES

• No ceiling on cell size. Solo operators register as a single‑operator cell.
• Each operator may root with only one cell. Dual‑citizenship is prohibited.
• Cell identifiers must not contain offensive or disruptive sigils.
• Token sharing across cells is a Class‑1 violation. Each cell earns its own access codes.

03 PACKET AUTHENTICATION PROTOCOLS

• Valid tokens match the schema STARPWN{.*} (printable ASCII only) unless the target node documentation specifies otherwise.
• Token verification is case‑sensitive. Submit the byte‑exact capture.
• No token hoarding. Exfiltrated credentials must be submitted immediately to maintain a fair operational tempo across all cells.

04 CREDIT ALLOCATION MATRIX

• The majority of targets employ dynamic scoring — payout degrades as more cells achieve access.
• Static bounties are explicitly flagged in the target briefing.
• All cells that compromise a given node receive identical credit, regardless of submission order.
• The cell with the highest accumulated credit at network blackout wins.
• In the event of a credit tie, the cell that reached the total first is ranked higher.

05 COUNTERMEASURE RESTRICTIONS

• Do not target the competition backbone — CTFd platform, scoring servers, or supporting infrastructure.
• Do not target other operator cells or their systems.
• Do not brute‑force token submission endpoints.
• Do not broadcast tokens, tactical intelligence, or solutions on public channels during active operations.
• Do not deploy automated payloads that spam or degrade network performance.
• Do not spin up duplicate cells or operator identities for unfair advantage.

06 HELP DESK FREQUENCIES

• Technical disruptions or intelligence requests should be directed to the Discord command channel.
• Node dispute claims must be filed before network blackout. Command will review each submission.
• Command reserves the right to amend protocols or burn operator credentials for egregious violations.

07 NEURAL CONDUCT PROTOCOLS

All operators must maintain a respectful and inclusive operational environment. Harassment, discrimination, or any form of abusive behaviour will not be tolerated and may result in immediate credential revocation.

08 AUGMENTED COGNITION FRAMEWORK

We believe the Grid is primarily a proving ground for human wetware — a space to challenge yourself, learn new exploits, and connect with the community. Allowing a synthetic cognition to run the majority of an operation undermines that ethos. That said, augmented tools are increasingly ubiquitous, impossible to police reliably, and can serve as legitimate force multipliers when wielded correctly.

Accordingly, the following directives apply:

• Fully or primarily autonomous cells are prohibited and will be burned. Operators may deploy any tools they choose, but reducing the human role to "yes/no" responses inverts the intended operator/tool hierarchy.
• Command reserves the right, at any point during the operation, to request a live debrief from any cell. Operators must be prepared to walk through their methodology on demand.
• The top 3 scoring cells will be required to submit abbreviated after‑action reports for a selection of compromised nodes. These need not be polished documents but must clearly outline the reasoning chain and key breakthrough points. Affected cells will be notified as network blackout approaches.

These directives reflect the core values of the operator community — preserving the signal-to-noise ratio and the integrity of the challenge space for both runners and architects. This framework was not developed in isolation. We acknowledge prior work by the command cells of Kalmar CTF, RITSEC CTF, DEFCON CTF, and other nodes who have mapped this territory before us.