Issues

• Profile and leaderboard disagree on totals with classic stories — count unlocked challenges only, with a disclaimer

  area:webenhancementscoringsize:M
  OWASP/owasp-ctf-in-a-box#570 · Filter by author dcotelo opened on Oct 3, 2026
  1

• Hints: a purchase can be charged a different price than the one confirmed

  area:adminarea:webbugscoringsize:M
  OWASP/owasp-ctf-in-a-box#557 · Filter by author dcotelo opened on Oct 2, 2026

• feat(web): a recent-solves feed on the projector board (post-event)

  area:webenhancementsize:L
  OWASP/owasp-ctf-in-a-box#542 · Filter by author dcotelo opened on Oct 1, 2026

• docs(agents): a comment policy — keep guard comments, move history to git and ADRs

  documentationprocesssize:S
  OWASP/owasp-ctf-in-a-box#505 · Filter by author dcotelo opened on Sep 29, 2026
  1

• refactor: maintainability follow-ups from the pre-v0.7.0 audit (post-event)

  javascriptsize:L
  OWASP/owasp-ctf-in-a-box#504 · Filter by author dcotelo opened on Sep 29, 2026
  1

• chore: remove dead code found by the pre-v0.7.0 audit

  javascriptsize:S
  OWASP/owasp-ctf-in-a-box#502 · Filter by author dcotelo opened on Sep 29, 2026
  1

• ci: path filters and gates that pass without proving anything

  github_actionssize:Mtest
  OWASP/owasp-ctf-in-a-box#498 · Filter by author dcotelo opened on Sep 29, 2026

• test: the team, rate-limit, admin-ops and admin-grant Lua scripts have no executing test

  hardeningsize:Mtest
  OWASP/owasp-ctf-in-a-box#497 · Filter by author dcotelo opened on Sep 29, 2026

• fix(setup): ctf-setup.sh hygiene — launch header, pull-grant answer, EVENT_URL echo

  hardeningsize:M
  OWASP/owasp-ctf-in-a-box#496 · Filter by author dcotelo opened on Sep 29, 2026
  2

• scoring: attempt caps and cooldowns are per login but scores are per team

  documentationscoringsize:S
  OWASP/owasp-ctf-in-a-box#494 · Filter by author dcotelo opened on Sep 29, 2026
  1

• fix(aws): srh survives an ElastiCache failover; a final snapshot on destroy

  hardeninginfrastructuresize:M
  OWASP/owasp-ctf-in-a-box#490 · Filter by author dcotelo opened on Sep 29, 2026
  1

• ci: make main's protection enforce the review and every gate (the CodeRabbit check passes unreviewed; stale approvals survive)

  github_actionshardeningprocesssize:M
  OWASP/owasp-ctf-in-a-box#487 · Filter by author dcotelo opened on Sep 29, 2026
  

• security: TLS on the stack's internal service hops (post-event follow-up to ADR 63)

  hardeninginfrastructuresecuritysize:L
  OWASP/owasp-ctf-in-a-box#484 · Filter by author dcotelo opened on Sep 28, 2026

• AWS deploy has never been applied, and its task definitions can't run a current event (no sign-in, sync and scorer won't start)

  buginfrastructureready-for-devsecuritysize:L
  OWASP/owasp-ctf-in-a-box#476 · Filter by author dcotelo opened on Sep 28, 2026
  1

  

• Jeopardy: solve-sharing is unmitigated when challenges are instanced per team

  enhancementscoringsize:L
  OWASP/owasp-ctf-in-a-box#447 · Filter by author RedTeamSpace opened on Sep 17, 2026
  1

• perf(leaderboard): close the last gap to 10 rps at 200 contestants (render cost after #444)

  enhancementhardeningsize:M
  OWASP/owasp-ctf-in-a-box#446 · Filter by author dcotelo opened on Sep 16, 2026

• hardening: per-login buckets on quiz answer and flag submit, throttled logins on Insights

  hardeningscoringsize:M
  OWASP/owasp-ctf-in-a-box#438 · Filter by author dcotelo opened on Sep 15, 2026
  2

• Serialize the category read-modify-write paths (setCategories, setAiCategories, renames)

  hardeningsize:M
  OWASP/owasp-ctf-in-a-box#349 · Filter by author dcotelo opened on Sep 7, 2026

• ai module: per-challenge attempt cap

  enhancementsize:M
  OWASP/owasp-ctf-in-a-box#252 · Filter by author dcotelo opened on Sep 2, 2026

• ai event signing key: dual-key rotation window

  enhancementhardeningsize:M
  OWASP/owasp-ctf-in-a-box#251 · Filter by author dcotelo opened on Sep 2, 2026

• Classic: accept more than one flag per challenge, and optional regex flags

  enhancementsize:M
  OWASP/owasp-ctf-in-a-box#192 · Filter by author dcotelo opened on Aug 23, 2026

• Classic: challenge prerequisites (unlock B by solving A)

  enhancementsize:M
  OWASP/owasp-ctf-in-a-box#191 · Filter by author dcotelo opened on Aug 23, 2026

• Classic: hidden challenges and scheduled release, so a board can be staged

  enhancementsize:M
  OWASP/owasp-ctf-in-a-box#189 · Filter by author dcotelo opened on Aug 23, 2026

• Classic: first blood

  enhancementscoringsize:S
  OWASP/owasp-ctf-in-a-box#188 · Filter by author dcotelo opened on Aug 23, 2026

• Classic: dynamic (decaying) points, the way modern CTFs score

  enhancementscoringsize:L
  OWASP/owasp-ctf-in-a-box#187 · Filter by author dcotelo opened on Aug 23, 2026