The modern, open-source CTF platform
Flagpost runs your whole capture-the-flag event: live scoreboards, a visual automation engine, support tickets and real-time team collaboration — self-hosted with one command, and yours forever.
- Apache-2.0 licensed
- CTFd-compatible import
docker compose upand you're live
Scoreboard
LIVE| # | Team | Solves | Score |
|---|---|---|---|
| 1 | hex&flex | 19 | 4,210 |
| 2 | mov eax,1337 | 18 | 3,980 |
| 3 | NullByte Collective | 17 | 3,745 |
| 4 | stack sm4shers | 16 | 3,520 |
| 5 | seg_fault_society | 15 | 3,310 |
Built on boring, proven tech
- FastAPI
- PostgreSQL
- Next.js
- Redis
- WebSockets
- Docker
- Caddy
Why Flagpost
Everything an organiser needs. Built in, and built already.
No plugin roulette, no duct-taped Discord workflows. Each of these ships in the box and works today.
Real-time everything
Scoreboard, presence, notifications and ticket threads update live over WebSockets. Nobody refreshes anything.
Visual automation engine
No-code When → If → Then rules: announce first blood, release hints on a timer, unlock bonus waves, freeze the board before the end.
Live collaborative notes
True CRDT co-editing on every challenge — a shared scratchpad for your team where everyone types at once, conflict-free.
Per-team challenge instances
Hand every team its own isolated, containerised copy of a challenge — launched on demand, reaped on a TTL, with unique per-instance flags. Docker or Kubernetes, behind one least-privilege contract.
Programming challengesNEW · v1.8.0
Put ICPC-style problems on the same board as your flags. Competitors upload or write code in the browser and get live verdicts against hidden tests, judged in throwaway, no-network containers — with rejudges, clarifications and problem-package import.
A skills web, not just a score
A per-player skills radar that spans every event on the install, and an organiser matrix that answers who's proficient, who's struggling and who's fresh — difficulty-weighted, with CSV export.
Modules & a marketplace
Install challenge and theme packs from an open, mirrorable registry — signed, trust-tiered, and off until you opt in. A documented SDK to build, sign and ship your own.
Secure by default
argon2 hashing, timing-safe auth, SSRF-hardened webhooks, ReDoS-contained regex flags — and no shipped credentials.
Production in one command
docker compose up brings up the app, Postgres, Redis, RustFS and Caddy behind one origin — with automatic HTTPS.
AI assistants, your model
An organiser assistant for live operational questions, and a guard-railed competitor assistant with organiser-set guidance levels and reviewable transcripts. Optional and off by default — bring any OpenAI-compatible endpoint, including a fully local model, so nothing leaves your install.
Automation
Your event runs itself. You watch it happen.
Every event on the platform — a solve, a ticket, the clock — can drive a rule you build visually. Notify people, release a hint, unlock a bonus wave, call a webhook, adjust a score, freeze the board, open the feedback survey. Schedule it all in advance and stop babysitting timers.
- Time-based triggers — “an hour before the end, open the survey and freeze the board.”
- SSRF-hardened webhooks — wire Flagpost into Slack, Discord or anything with a URL, safely.
- Full audit trail — every rule firing is logged with what it did and why.
event: challenge.solved · first_solve = true
condition: team.bracket == open
- Post announcement: “🩸 First blood on Heap of Trouble!”
- Grant award: First Blood (+50)
- Notify the judge team
#214 — “Is the flag format flag{…} for RSA-mble?”
seg_fault_society: we keep getting “invalid format” on our submission
judge · ava: Yes — flag{…}, all lowercase. Check for a trailing newline.
replied in 1m 40s · linked to challenge RSA-mble
Team notes — Heap of Trouble
KMRoffset is 0x48 → tcache poisoning works
libc 2.39, no safe-linking on this build
Operations
Close the Discord back-channel.
Everything that usually sprawls across chat servers and spreadsheets lives in the platform: competitors file support tickets into a live staff queue, announcements land as a banner everywhere, presence shows who's looking at what, and every challenge carries a real-time shared notepad for the team working it.
- A live support queue with assignment, private staff notes and an audio cue for new tickets.
- Feedback built in — post-event surveys and per-challenge ratings, exportable for your retro.
- A customisable operational dashboard — add live widgets from a catalogue (unsolved challenges, team activity, brute-force watch, instance health) and arrange them per user, plus a full audit log.
Compared
The basics are everywhere. The event layer isn't.
Most platforms score flags perfectly well. The difference is everything around the scoring — the operations you otherwise duct-tape together on event day.
| Capability | Flagpost | Other platforms |
|---|---|---|
| Scoreboard essentialsFirst blood, freeze, dynamic decay scoring | Built in | Built in — table stakes |
| Real-time everythingLive board, presence, notifications, ticket threads | WebSockets throughout | Refresh or polling |
| Automation engineVisual When → If → Then rules on any platform event | Built in | — |
| Support ticketsLive staff queue, assignment, internal notes, audio cue | Built in | Discord or external tools |
| Team collaborationShared real-time notes on every challenge (CRDT) | Built in | External docs & chat |
| Roles & permissionsCustom roles, granular per-competition scope | Data-driven role editor | Fixed roles, typically |
| Single sign-onOIDC, OAuth2, SAML 2.0 & LDAP/AD — Google, Entra, GitHub, Discord, Shibboleth, Active Directory; local login as break-glass | Built in, free | Paid tiers or plugins, typically |
| On-demand challenge instancesPer-team isolated containers, unique flags, TTL reaping — Docker or Kubernetes | Built in — optional module | Third-party add-on (e.g. CTFd-Whale) |
| Cross-competition skillsPer-player skills radar + an organiser skills matrix, difficulty-weighted, with CSV export | Built in | — |
| Modules & marketplaceInstall signed challenge & theme packs from an open, mirrorable registry; SDK to build your own | Built in — opt-in, air-gappable | Plugins, no signed registry |
| AI assistantsOrganiser Q&A + guard-railed competitor help — reviewable transcripts, bring your own model | Built in — optional, off by default | — |
| Post-event reportingBranded PDF/HTML wrap-up — participation, results, challenges, support, feedback | One click, built in | Export CSV, build it yourself |
| Licence & costEvery feature, self-hosted | Apache-2.0 — all of it, free | Open core; paid tiers common |
* Built-in capabilities of typical self-hosted CTF platforms — without plugins or paid tiers — as we understand them in mid-2026. Spot something wrong or outdated? Tell us and we'll fix it.
Already running another platform? Your ctfcli challenge repo imports as-is — switching is an afternoon, not a rewrite.
CTFd migration guideQuick start
Live before your coffee cools.
Three commands bring up the entire production stack — app, PostgreSQL, Redis, RustFS and a Caddy reverse proxy on a single origin. Open localhost:8080 and a one-time setup wizard creates your owner account. No seeded passwords, nothing else to configure.
Going public? Set your domain in .env and Caddy obtains and renews HTTPS certificates automatically.
$ git clone https://github.com/tbcsec/flagpost.git
$ cd flagpost
$ docker compose up --build✓ caddy · serving on :8080
✓ backend · migrations applied, event bus up
→ open http://localhost:8080 to run the setup wizard
Open source
Open source. No asterisks.
Your competition data lives in your Postgres. Challenges, teams — the whole platform state — export on demand. If Flagpost ever stops being right for you, you take everything with you.
Apache-2.0 licensed
Permissive terms with an explicit patent grant and no copyleft strings. Use it anywhere — self-host, modify, embed or build a service on it, commercially or otherwise.
Read the licenceBuilt in the open
Public roadmap, architecture decision records for every big call, and a contributor guide that gets you to a first PR fast.
Contributing guideSecurity-first
A private disclosure policy, hardening decisions documented, and secure defaults — because it's a security platform.
Security policyLike where this is going? A star helps other organisers find it.
tbcsec/flagpostRoadmap
The next flags to plant.
These are the big swings coming to the platform, built in the open like everything else — and ticked off here as they ship.
TodaySHIPPED
Real-time competitions, the automation engine, per-team challenge instances, programming challenges with a built-in code judge, AI assistants, collaborative notes, single sign-on, a cross-competition skills web, a module marketplace, certificates, post-event reports, four interface languages and CTFd-compatible import — everything on this page ships now, Apache-2.0.
More authentication modulesSHIPPED · v1.3.0
Delivered across two releases on one pluggable identity framework: OIDC/OAuth2 single sign-on in v1.2.0, then SAML 2.0 and LDAP/Active Directory in v1.3.0 — local login always surviving as break-glass.
AI chatbotSHIPPED · v1.4.0
Shipped as an optional module, off by default: an administrator assistant for operational Q&A over a competition, and a guard-railed, audience-aware assistant for competitors — reviewable transcripts, bring-your-own provider.
Custom certificate generationSHIPPED · v1.5.0
Shipped as an optional module: an in-app A4 designer over server-rendered PNGs, drawing name, placement, points and more from the final standings; released on a schedule or on demand, downloaded per participant or exported in bulk.
On-demand challenge instancesSHIPPED · v1.6.0
An isolated, containerised copy of a challenge for each team or player, spun up on demand and reaped on a TTL — reached over TCP or a per-instance HTTPS subdomain, with unique per-instance flags and a Docker or Kubernetes provisioner behind one least-privilege contract. Live infrastructure for pwn-, web- and cloud-heavy events.
Module SDK, importing & marketplaceSHIPPED · v1.7.0
Shipped first in v1.7.0: install signed, trust-tiered challenge and theme packs from an open, mirrorable registry — off until an operator opts in — plus a documented SDK to build, sign and validate your own. Declarative and signed-code modules, and a sandbox, are designed and still to come.
Programming challengesSHIPPED · v1.8.0
Shipped in v1.8.0: a built-in code judge. Competitors upload or write code in the browser and get live verdicts against hidden tests, scored on the same board as flags; judges rejudge, override and answer clarifications, and ICPC problem packages import and export. An optional module, off until an operator connects a judge runtime. An ICPC-style ranking mode is still to come.
Cheat detection engine
Flag-sharing and anomaly signals surfaced to judges — evidence for humans, not silent auto-bans.
Have a say
The roadmap is shaped in the open. Propose a feature, or weigh in on what should come first.
Join the discussion
FAQ
Questions organisers ask
What is a CTF platform?
A CTF (capture-the-flag) platform is the software that runs a security competition: it publishes challenges, accepts and validates flag submissions, keeps score in real time, and gives organisers the tools to manage teams, hints and support. Flagpost is a modern, open-source CTF platform you host yourself.
Is Flagpost free?
Yes. Flagpost is open source under the Apache-2.0 licence — permissive, with an explicit patent grant. There is no hosted tier, no feature gate and no telemetry — you run it on your own infrastructure and your competition data stays yours.
Is Flagpost an alternative to CTFd?
Yes — Flagpost is a modern, open-source CTFd alternative, built for organisers who want real-time operations, a visual automation engine, and many competitions on one install. It reads CTFd's ctfcli challenge format, so trying it with your existing challenges takes minutes, and the docs carry a full, honest feature-by-feature comparison.
Read the Flagpost vs CTFd comparison →Can I import my competition from CTFd?
Yes. Flagpost bulk-imports and exports challenges in the ctfcli YAML format used by CTFd, so an existing challenge repository drops straight in — including each challenge's live-service connection info, which round-trips faithfully. There is also a one-click, full-fidelity platform backup for exporting or importing an entire install.
Can I build a commercial module for Flagpost?
Yes. Flagpost is Apache-2.0 — a permissive licence — so you can build modules on top of it, or embed the platform itself, under any terms you like, including proprietary ones, with no copyleft obligation. The only thing the licence doesn't grant is the Flagpost name and marks, which stay reserved.
Read about developing modules →What do I need to self-host Flagpost?
Docker with Compose on a single machine. One command starts the app, PostgreSQL, Redis, RustFS and a Caddy reverse proxy; point it at your domain and HTTPS certificates are obtained and renewed automatically.
Does it support team and individual competitions?
Both, chosen per competition: team mode with invite codes, optional captain approval and size caps, or individual mode with a personal roster. A single install is multi-tenant and can run many competitions, public or private.
Is the scoreboard really real-time?
Yes — standings, first-blood markers, presence and notifications stream over WebSockets rather than polling. There is a public spectator board with a full-screen venue mode for projectors — rotating the board, insights and timeline, with first-blood splashes — plus brackets for parallel divisions, a scoreboard freeze for the final stretch, and a CTFtime-compatible feed for rated events.
Can Flagpost run per-team challenge instances?
Yes. An optional module hands each team or player its own isolated, containerised copy of a challenge — launched on demand, reaped on a timer, with unique per-instance flags so a leaked flag doesn't unlock the challenge for everyone. It runs on your own Docker host or a Kubernetes cluster behind a least-privilege provisioner, exposes challenges over TCP or a per-instance HTTPS subdomain, and stays off until you configure it.
Read the challenge-instances guide →