The modern, open-source CTF platform
Flagpost runs your whole capture-the-flag event: live scoreboards, a visual automation engine, support tickets and real-time team collaboration — self-hosted with one command, and yours forever.
- Apache-2.0 licensed
- CTFd-compatible import
docker compose upand you're live
Scoreboard
LIVE| # | Team | Solves | Score |
|---|---|---|---|
| 1 | hex&flex | 19 | 4,210 |
| 2 | mov eax,1337 | 18 | 3,980 |
| 3 | NullByte Collective | 17 | 3,745 |
| 4 | stack sm4shers | 16 | 3,520 |
| 5 | seg_fault_society | 15 | 3,310 |
Built on boring, proven tech
- FastAPI
- PostgreSQL
- Next.js
- Redis
- WebSockets
- Docker
- Caddy
Why Flagpost
Everything an organiser needs. Built in, and built already.
No plugin roulette, no duct-taped Discord workflows. Each of these ships in the box and works today.
Real-time everything
Scoreboard, presence, notifications and ticket threads update live over WebSockets. Nobody refreshes anything.
Visual automation engine
No-code When → If → Then rules: announce first blood, release hints on a timer, unlock bonus waves, freeze the board before the end.
Live collaborative notes
True CRDT co-editing on every challenge — a shared scratchpad for your team where everyone types at once, conflict-free.
A scoreboard done right
First blood, brackets and divisions, a freeze for the final stretch, a public spectator board with a big-screen venue mode, and a CTFtime feed.
A deep challenge model
Static, regex and multiple-choice flags. Dynamic decay scoring, prerequisite unlock chains, scheduled releases, guess caps.
Per-team challenge instances
Hand every team its own isolated, containerised copy of a challenge — launched on demand, reaped on a TTL, with unique per-instance flags. Docker or Kubernetes, behind one least-privilege contract.
Permissions as data
RBAC that isn't hard-coded: clone the built-in roles and craft custom ones with per-competition or site-wide scope.
No lock-in, ever
CTFd-compatible ctfcli YAML import and export, plus a one-click, full-fidelity backup of your entire install.
Secure by default
argon2 hashing, timing-safe auth, SSRF-hardened webhooks, ReDoS-contained regex flags — and no shipped credentials.
Production in one command
docker compose up brings up the app, Postgres, Redis, MinIO and Caddy behind one origin — with automatic HTTPS.
Certificates worth sharing
Design one template; every participant downloads a server-rendered certificate drawn from the final standings. A certificate on LinkedIn is an impression for your event.
The write-up writes itself
End the competition and generate a branded PDF report — participation, results, challenge analysis, support and feedback — from the data you already have. The document you email a sponsor on Monday.
Speaks your language
The interface ships in English, Français, Español and Polski, chosen per device — with a Crowdin workflow for adding more. Your challenge text and announcements stay in your words.
AI assistants, your modelNEW · v1.4.0
An organiser assistant for live operational questions, and a guard-railed competitor assistant with organiser-set guidance levels and reviewable transcripts. Optional and off by default — bring any OpenAI-compatible endpoint, including a fully local model, so nothing leaves your install.
Automation
Your event runs itself. You watch it happen.
Every event on the platform — a solve, a ticket, the clock — can drive a rule you build visually. Notify people, release a hint, unlock a bonus wave, call a webhook, adjust a score, freeze the board, open the feedback survey. Schedule it all in advance and stop babysitting timers.
- Time-based triggers — “an hour before the end, open the survey and freeze the board.”
- SSRF-hardened webhooks — wire Flagpost into Slack, Discord or anything with a URL, safely.
- Full audit trail — every rule firing is logged with what it did and why.
event: challenge.solved · first_solve = true
condition: team.bracket == open
- Post announcement: “🩸 First blood on Heap of Trouble!”
- Grant award: First Blood (+50)
- Notify the judge team
#214 — “Is the flag format flag{…} for RSA-mble?”
seg_fault_society: we keep getting “invalid format” on our submission
judge · ava: Yes — flag{…}, all lowercase. Check for a trailing newline.
replied in 1m 40s · linked to challenge RSA-mble
Team notes — Heap of Trouble
KMRoffset is 0x48 → tcache poisoning works
libc 2.39, no safe-linking on this build
Operations
Close the Discord back-channel.
Everything that usually sprawls across chat servers and spreadsheets lives in the platform: competitors file support tickets into a live staff queue, announcements land as a banner everywhere, presence shows who's looking at what, and every challenge carries a real-time shared notepad for the team working it.
- A live support queue with assignment, private staff notes and an audio cue for new tickets.
- Feedback built in — post-event surveys and per-challenge ratings, exportable for your retro.
- A customisable operational dashboard — add live widgets from a catalogue (unsolved challenges, team activity, brute-force watch, instance health) and arrange them per user, plus a full audit log.
Compared
The basics are everywhere. The event layer isn't.
Most platforms score flags perfectly well. The difference is everything around the scoring — the operations you otherwise duct-tape together on event day.
| Capability | Flagpost | Other platforms |
|---|---|---|
| Scoreboard essentialsFirst blood, freeze, dynamic decay scoring | Built in | Built in — table stakes |
| Real-time everythingLive board, presence, notifications, ticket threads | WebSockets throughout | Refresh or polling |
| Automation engineVisual When → If → Then rules on any platform event | Built in | — |
| Support ticketsLive staff queue, assignment, internal notes, audio cue | Built in | Discord or external tools |
| Team collaborationShared real-time notes on every challenge (CRDT) | Built in | External docs & chat |
| Roles & permissionsCustom roles, granular per-competition scope | Data-driven role editor | Fixed roles, typically |
| Single sign-onOIDC, OAuth2, SAML 2.0 & LDAP/AD — Google, Entra, GitHub, Discord, Shibboleth, Active Directory; local login as break-glass | Built in, free | Paid tiers or plugins, typically |
| Multi-competitionMany isolated events from one install | Multi-tenant core | One event per instance, typically |
| Deep challenge modelRegex & multiple-choice flags, unlock chains, waved release, guess caps | All built in | Partial — often plugins |
| On-demand challenge instancesPer-team isolated containers, unique flags, TTL reaping — Docker or Kubernetes | Built in — optional module | Third-party add-on (e.g. CTFd-Whale) |
| Feedback & analyticsSurveys, post-solve ratings, challenge health, insight cards | Built in | Basic stats |
| AI assistantsOrganiser Q&A + guard-railed competitor help — reviewable transcripts, bring your own model | Built in — optional, off by default | — |
| Participation certificatesIn-app designer, server-rendered per participant, released and shared | Built in | — |
| Post-event reportingBranded PDF/HTML wrap-up — participation, results, challenges, support, feedback | One click, built in | Export CSV, build it yourself |
| Interface languagesEnglish, Français, Español, Polski — with a Crowdin translator workflow | Four maintained locales | Community translations, varies |
| Divisions & spectatorsBrackets, public spectator board + insights, full-screen venue mode, CTFtime feed | Built in | Varies |
| Portabilityctfcli-format challenge import/export, full platform backup | No lock-in by design | Varies |
| Licence & costEvery feature, self-hosted | Apache-2.0 — all of it, free | Open core; paid tiers common |
* Built-in capabilities of typical self-hosted CTF platforms — without plugins or paid tiers — as we understand them in mid-2026. Spot something wrong or outdated? Tell us and we'll fix it.
Already running another platform? Your ctfcli challenge repo imports as-is — switching is an afternoon, not a rewrite.
CTFd migration guideQuick start
Live before your coffee cools.
Three commands bring up the entire production stack — app, PostgreSQL, Redis, MinIO and a Caddy reverse proxy on a single origin. Open localhost:8080 and a one-time setup wizard creates your owner account. No seeded passwords, nothing else to configure.
Going public? Set your domain in .env and Caddy obtains and renews HTTPS certificates automatically.
$ git clone https://github.com/tbcsec/flagpost.git
$ cd flagpost
$ docker compose up --build✓ caddy · serving on :8080
✓ backend · migrations applied, event bus up
→ open http://localhost:8080 to run the setup wizard
Open source
Open source. No asterisks.
Your competition data lives in your Postgres. Challenges, teams — the whole platform state — export on demand. If Flagpost ever stops being right for you, you take everything with you.
Apache-2.0 licensed
Permissive terms with an explicit patent grant and no copyleft strings. Use it anywhere — self-host, modify, embed or build a service on it, commercially or otherwise.
Read the licenceBuilt in the open
Public roadmap, architecture decision records for every big call, and a contributor guide that gets you to a first PR fast.
Contributing guideSecurity-first
A private disclosure policy, hardening decisions documented, and secure defaults — because it's a security platform.
Security policyLike where this is going? A star helps other organisers find it.
tbcsec/flagpostRoadmap
The next flags to plant.
These are the big swings coming to the platform, built in the open like everything else — and ticked off here as they ship.
TodaySHIPPED
Real-time competitions, the automation engine, AI assistants, collaborative notes, single sign-on, shareable certificates, post-event reports, four interface languages, CTFd-compatible import — everything on this page ships now, Apache-2.0.
More authentication modulesSHIPPED · v1.3.0
Delivered across two releases on one pluggable identity framework: OIDC/OAuth2 single sign-on in v1.2.0, then SAML 2.0 and LDAP/Active Directory in v1.3.0 — local login always surviving as break-glass.
AI chatbotSHIPPED · v1.4.0
Shipped as an optional module, off by default: an administrator assistant for operational Q&A over a competition, and a guard-railed, audience-aware assistant for competitors — reviewable transcripts, bring-your-own provider.
Custom certificate generationSHIPPED · v1.5.0
Shipped as an optional module: an in-app A4 designer over server-rendered PNGs, drawing name, placement, points and more from the final standings; released on a schedule or on demand, downloaded per participant or exported in bulk.
On-demand challenge instancesSHIPPED · v1.6.0
An isolated, containerised copy of a challenge for each team or player, spun up on demand and reaped on a TTL — reached over TCP or a per-instance HTTPS subdomain, with unique per-instance flags and a Docker or Kubernetes provisioner behind one least-privilege contract. Live infrastructure for pwn-, web- and cloud-heavy events.
Module SDK, importing & marketplace
A documented SDK for building modules, clean packaging and import, and a marketplace with verified publishers.
Programming challenges
Programming and secure-coding formats as first-class competition types beside CTFs.
Cheat detection engine
Flag-sharing and anomaly signals surfaced to judges — evidence for humans, not silent auto-bans.
Have a say
The roadmap is shaped in the open. Propose a feature, or weigh in on what should come first.
Join the discussion
FAQ
Questions organisers ask
What is a CTF platform?
A CTF (capture-the-flag) platform is the software that runs a security competition: it publishes challenges, accepts and validates flag submissions, keeps score in real time, and gives organisers the tools to manage teams, hints and support. Flagpost is a modern, open-source CTF platform you host yourself.
Is Flagpost free?
Yes. Flagpost is open source under the Apache-2.0 licence — permissive, with an explicit patent grant. There is no hosted tier, no feature gate and no telemetry — you run it on your own infrastructure and your competition data stays yours.
Is Flagpost an alternative to CTFd?
Yes — Flagpost is a modern, open-source CTFd alternative, built for organisers who want real-time operations, a visual automation engine, and many competitions on one install. It reads CTFd's ctfcli challenge format, so trying it with your existing challenges takes minutes, and the docs carry a full, honest feature-by-feature comparison.
Read the Flagpost vs CTFd comparison →Can I import my competition from CTFd?
Yes. Flagpost bulk-imports and exports challenges in the ctfcli YAML format used by CTFd, so an existing challenge repository drops straight in — including each challenge's live-service connection info, which round-trips faithfully. There is also a one-click, full-fidelity platform backup for exporting or importing an entire install.
Can I build a commercial module for Flagpost?
Yes. Flagpost is Apache-2.0 — a permissive licence — so you can build modules on top of it, or embed the platform itself, under any terms you like, including proprietary ones, with no copyleft obligation. The only thing the licence doesn't grant is the Flagpost name and marks, which stay reserved.
Read about developing modules →What do I need to self-host Flagpost?
Docker with Compose on a single machine. One command starts the app, PostgreSQL, Redis, MinIO and a Caddy reverse proxy; point it at your domain and HTTPS certificates are obtained and renewed automatically.
Does it support team and individual competitions?
Both, chosen per competition: team mode with invite codes, optional captain approval and size caps, or individual mode with a personal roster. A single install is multi-tenant and can run many competitions, public or private.
Is the scoreboard really real-time?
Yes — standings, first-blood markers, presence and notifications stream over WebSockets rather than polling. There is a public spectator board with a full-screen venue mode for projectors — rotating the board, insights and timeline, with first-blood splashes — plus brackets for parallel divisions, a scoreboard freeze for the final stretch, and a CTFtime-compatible feed for rated events.
Can Flagpost run per-team challenge instances?
Yes. An optional module hands each team or player its own isolated, containerised copy of a challenge — launched on demand, reaped on a timer, with unique per-instance flags so a leaked flag doesn't unlock the challenge for everyone. It runs on your own Docker host or a Kubernetes cluster behind a least-privilege provisioner, exposes challenges over TCP or a per-instance HTTPS subdomain, and stays off until you configure it.
Read the challenge-instances guide →