CTF Competition Platform

A full-featured Capture The Flag competition platform I designed for university clubs, corporate security training and CTF programs. Users solve challenges across categories, earn points, form teams and compete on leaderboards.

Highlights

• Season-based competitions with countdown timers.
• Dynamic scoring — the more people solve a challenge, the lower its points drop.
• First Blood tracking, multi-step hints, prerequisite chains.
• Team system, achievements/badges, live solve timeline, admin-approved writeups.
• Analytics: personal dashboard, score charts, category progress, CSV export.

Security focus

A CTF platform is played by attackers, so the platform itself must be hardened: rate limiting on login and flag submission, CSRF on all forms, server-side XSS sanitization, CSP + HSTS + X-Frame-Options + COOP/CORP, no-store on auth pages and a secret-path admin URL.

Stack

Django 4.2, SQLite (dev) / PostgreSQL (prod), Redis cache, multilingual, GitHub-like dark theme, Chart.js. Multi-stage Dockerfile + docker-compose (Postgres + Redis + Nginx) + Gunicorn.

What I learned

Getting dynamic scoring right was harder than expected — instead of freezing points at solve time I built a model that recomputes continuously so historical rankings stay consistent. Prerequisite chains required graph logic to prevent cyclic dependencies.