Rules
Education first, competition second.
AI tools have become good enough to one-shot many CTF challenges, and AI use cannot be fairly policed across a large online field. Rather than ban or detect AI, we ask players to self-identify their tool use — and we make the decisive round, the in-person final, AI-free for everyone.
Stages
1 · Online qualifier
Tuesday 27 October, noon → Friday 30 October, 6:00 AM
Mountain Time (MDT, UTC−6)
A Jeopardy-style board grouped by category. Solve a challenge, submit its flag, earn points. Most challenges use dynamic scoring — they open at 1000 points and decay as more players solve them. Some are static.
2 · In-person final
Friday 30 October, 8:30–10:30 AM
Mountain Time (MDT, UTC−6)
Proctored, up to 5 contestants (4 merit seats plus up to 1 reserved minimal-AI seat). Every challenge is worth the same. AI is prohibited during the final — ChatGPT, Claude, agents and similar. The Black Badge is decided here.
Scoreboards
Three public boards, visible throughout. We do not hide the scoreboard.
- Combined — everyone.
- Minimal-AI — players who self-identified as minimal-AI.
- Maxi-AI — players who self-identified as fully AI-assisted.
AI self-identification
At registration each player declares minimal-AI or maxi-AI. This is on the honor system and is not policed across the field — it only carries weight for the one reserved final seat, where the claim is backed by a solve writeup.
minimal-AI — you solved the challenges under your own power. Search engines, documentation, past writeups and standard tools are all fair game, and you may ask an AI assistant to explain a general concept. But AI did not analyze a specific challenge for you, write your exploit or solution code, or produce a flag. The analysis, the insight and the exploit were yours.
maxi-AI — any use of AI, LLMs or agents to help you solve: analyzing a challenge, reasoning through it, generating exploit or solution code, autonomous agent solving, or AI coding assistants leaned on for your solution.
When in doubt, declare maxi-AI. Declaring minimal-AI is a claim you may have to back with a writeup, and nothing is lost by declaring maxi — only the reserved final seat depends on the minimal declaration. Incidental AI you didn't lean on, such as an autocomplete suggestion, isn't disqualifying by itself; relying on AI to solve is.
This restricts tool use, not collaboration. Working with, hinting to, or social-engineering other players is allowed for everyone (see Ethics) and does not affect your minimal-AI status.
Advancement to the final
Four to five seats:
- 4 seats — merit, category-blind. The top 4 on the combined qualifier board, whatever their self-identified track. Standard tie-break favors the earlier solver.
- 1 seat — reserved minimal-AI, verified by writeup. Filled from the reserved-seat pool via the process below.
Overlap rule
The 4 merit seats are pulled first. The reserved-seat pool is then the 5 highest minimal-AI players who are not already holding a merit seat. If a minimal-AI player is in the combined top 4 they take the merit seat, and the next-highest minimal player is pulled up to keep the pool 5 deep. No one takes two seats, and the 5th seat is strictly a minimal-AI seat.
Reserved-seat writeup process
- Thursday evening — all minimal-AI players are notified through CTFd which challenges will require writeups, so anyone in contention can prepare overnight, before they know their final rank.
- Friday 6:00 AM — the qualifier closes; the minimal-AI board is final and the top 5 are known.
- Friday 6:30 AM — writeups due. Any of the reserved-seat pool who want the seat submit writeups for the announced challenges. Writeups are prepared overnight; the 30-minute window is just for submitting.
- Friday 7:00 AM — HC staff review in board order and walk down the pool until the first acceptable candidate. That player takes the reserved seat.
- Floor — if none of the pool submit an acceptable writeup, or all decline, the reserved seat stays empty and the final runs with the 4 merit players. The seat is never backfilled from the combined or maxi board: it belongs to the minimal track, earned or vacant.
Writeup judging criteria
A writeup is acceptable if it demonstrates your own solving process — the reasoning, the dead ends, and the steps that led to the flag — at a level consistent with having solved it yourself. It is not a style contest; it is evidence of authorship. Missing writeups, or writeups that only restate the challenge or paste output without process, are not acceptable.
Friday timeline
| Time | Event |
|---|---|
| Thu 29 Oct, evening | Minimal-AI players notified which challenges need writeups |
| Fri 30 Oct, 6:00 AM | Qualifier closes; minimal-AI top 5 finalized |
| Fri 30 Oct, 6:30 AM | Reserved-seat writeups due |
| Fri 30 Oct, 7:00 AM | Reserved-seat selection complete |
| Fri 30 Oct, 8:30–10:30 AM | In-person final |
All times Mountain Time (MDT, UTC−6).
Ethics
- Do not brute-force the scoring servers.
- Do not steal flags from other players. Sharing hints is fine; sharing flags is not.
- Do not sabotage challenges for other players.
- Social-engineering other players is permitted.
- Register with the same email you used for SAINTCON, and bring a laptop.
- HC staff reserve the right to disqualify players or adjust scores for rule violations.
Prize
The overall winner receives a Black Badge — free entry to SAINTCON for life. Not one year: every year, for as long as there is a SAINTCON to attend.