# Grid Defenders CTF The Grid Defenders CTF is a rolling capture-the-flag program. We post security challenges against National Compute and against partner systems, each with a prize, and the first person to capture a challenge's flag and send a write-up wins it. Challenges open and retire continuously; there are no seasons and no end date. The CTF is the hands-on part of the [Grid Defenders program](https://console.nationalcompute.com/public/checkpoints/69555212-6025-5bca-8547-6dd310f9d577). It is the only way to get an account or access from us for security research. The [bug bounty](https://docs.nationalcompute.com/bug-bounty.md) never provides one. ## Joining 1. **Apply** through the [Grid Defenders form](https://console.nationalcompute.com/public/checkpoints/69555212-6025-5bca-8547-6dd310f9d577). 2. **We review** the application. Acceptance is at our discretion. 3. **Sign the participation agreement** in your legal name. You must be 18 or older. The agreement authorizes your testing within the [rules](#rules) and makes them binding. 4. **Get your CTF account**: a National Compute account in an organization of its own, with access to the challenge portal. This page is a plain summary of the agreement. Where the two differ, the agreement wins. The CTF account is for the program only. The capacity a challenge needs is provided at no cost to you. Running your own workloads on the account, or using it for anything else, ends your membership. ## Challenges The portal lists every open challenge with its target, its goal, its prize, and any rules of its own. The goal is a flag: a secret string placed where only a successful attack reaches it, such as a file in a cluster your account was not given, an object in a bucket it cannot read, or a value in a workspace that is not yours. Every flag sits in systems we or a partner set up as the target. | Kind | What it is | |---|---| | Staged | A target we built with weaknesses on purpose. The flag is known to be reachable. | | Live | A flag placed behind a real boundary of the production platform, in an organization we own. Nobody knows whether it can be reached: reaching it takes a flaw we have not found. | A challenge stays open until it is claimed or we retire it. We may retire a challenge at any time, claimed or not, and the portal says when we do. ### Partner challenges Some challenges run on another compute provider's systems with that provider's agreement, for example to test and harden its tenant isolation. They can be staged or live; a live partner challenge places its flag behind a real boundary of the partner's own production systems. The portal names the partner on the challenge; this page does not. A partner challenge may carry extra rules from the partner, and the partner receives the write-up. ## Rules The agreement's protection covers what you do within these rules. - **Attack only the challenge's target**, from your CTF account. Anything a challenge does not name is outside the CTF. There the [bug bounty's rules](https://docs.nationalcompute.com/bug-bounty.md#rules-of-engagement) apply to you as to anyone else. - **Stop at the flag.** The flag is the proof. Once you have it, do not keep access, go further, or come back for more. - **Real data means stop.** If you reach anything that is not part of a challenge (a customer's data, a staff system, another participant's account), stop at once, read nothing more, and report it to security@nationalcompute.com. It is rated under the bug bounty. - **No damage.** No denial of service and no load or volume attacks. Live challenges run on the production platform next to real tenants: nothing you do may slow or break a system other people use. Remove what you installed when you are done. - **No people, no premises.** No social engineering or phishing of staff, partners or tenants, and no physical access. - **One person per account.** Do not share the account, its credentials or its capacity, and do not attack other participants. - **Keep it private.** Do not share flags or solutions. Publish only as [Disclosure](#disclosure) allows. Breaking a rule ends your membership, ends the agreement's protection for what you did outside the rules, and forfeits any prize the claim would have won. If you break a rule by mistake, tell us at once: a prompt, honest account is treated as good faith. ## Claiming a prize 1. Submit the flag in the portal. The portal records the time, and the first valid flag is first in line. 2. Send a write-up within 7 days of the flag: how you reached it, step by step, enough for us to reproduce it. If no write-up arrives in time, the claim lapses and the next valid flag is first in line. 3. We reproduce it from the write-up, mark the challenge Claimed, and pay the prize. The portal's leaderboard shows the winner's handle beside the challenge if the winner opts in. Otherwise it shows Claimed and nothing more. Prizes are paid on the bug bounty's terms ([rewards and eligibility](https://docs.nationalcompute.com/bug-bounty.md#rewards-and-eligibility)): US dollars by PayPal or platform credits at 1.5 times the amount, tax paperwork first, and the same people ineligible. ### A real flaw in a challenge Capturing a live challenge's flag takes a real flaw in the platform, and a staged challenge can be solved through a flaw we did not plant. Either way the flaw is paid once: the challenge prize or the bug bounty reward for it, whichever is higher. ## Disclosure Until publication is allowed, the details stay between you, us and, for a partner challenge, the partner. You may publish your write-up once the challenge is retired and any fix it needed has shipped, after telling us at least 7 days ahead. A partner challenge also needs the partner's consent. Publishing earlier forfeits the prize and the agreement's protection.