WSH 26 / Rules
Rules
Read this before you register. Entering the event means your whole team accepts these terms. Anything added or amended before the event will be published here.
No AI in the CTF. Browser AI for projects only.
Any AI used during the CTF is strictly prohibited — browser-based or otherwise. Publicly available browser-based AI assistants are allowed for the hackathon project track only.
Local AI agents, offline LLMs and any locally deployed model weights are prohibited on both tracks — that includes tools such as OpenClaw, Hermes, and anything else running on your own machine.
Volunteers monitor the floor continuously across both days and run periodic device checks for compliance. Violation means immediate disqualification from the affected track.
Kali Linux is mandatory.
Every participant, on both tracks, works from Kali Linux. This is not a recommendation and there is no exemption. Bare metal, dual boot or a virtual machine are all acceptable — what matters is that your machine boots into a working, updated Kali install when you walk in.
All participants must bring their own laptop and charger.
There is no setup window on the day. A team that arrives without Kali is a team spending its first hours installing an operating system.
Team rules
Competition rules
Applies across both tracks unless a rule names one specifically.
Flags, solutions, exploit scripts and hints stay inside your team for the duration of the event. Passing a flag to another team — or taking one — disqualifies everyone involved.
- No shared documents, group chats or drop points between teams
- No solving a challenge on another team's behalf
- Talking through general concepts is fine; handing over an answer is not
The scope is the challenge infrastructure given to you, and nothing else. Everything outside that scope is off limits without exception.
- No attacks against the scoring platform or event infrastructure
- No attacks against the school network, its devices, or its systems
- No attacks against other teams, their machines or their accounts
- No denial-of-service, flooding or brute-force against anything unless a challenge explicitly says so
- No targeting third-party systems on the internet
Event Wi-Fi is isolated from the school's main network, with port and protocol restrictions applied by the school IT team and dedicated segmentation protecting school systems. Attempting to cross that boundary is a disqualifying offence.
Anything found outside scope should be reported to an organiser, not exploited.
Your project is written during the event, on top of the starter kit distributed at the Day 1 briefing. You may not arrive with a part-built product and finish it on site.
- The provided starter kit — a GitHub repository with backend code and free API integrations — is the only pre-existing code you build on
- The project must be security-focused; it complements the CTF track
- Open-source libraries, frameworks and public APIs are allowed and expected
- You must be able to explain and demonstrate any code you submit
- Submissions close at 11:40 on Day 2, followed by a two to five minute pitch
Work you submit is your team's own. Public tools, references and documentation are fair game; presenting someone else's solution or project as yours is not.
Scoring, ruling on disputes, judging outcomes and any decision on eligibility rest with the organising team. Challenges may be adjusted, re-scored or pulled if a problem is found, and the rules may be clarified during the event.
The CTFd platform closes at 10:00 on Day 2. Project submissions are due at 11:40 on Day 2. Nothing submitted after those times is scored, for any reason.
Supervision & network
Two things worth knowing before you arrive: you will be supervised, and the network you are on is not the school's.
You will be monitored
Continuous floor monitoring across both days, periodic device checks for policy compliance, and immediate escalation of any concern to the lead organisers. Volunteers are identifiable throughout the event.
A separate network
Event Wi-Fi is isolated from the school's main network, with port and protocol restrictions applied by the school IT team and dedicated segmentation protecting school systems. Participants use the event network only.
Code of conduct
Respect the room
You are guests at Westminster School Dubai. Treat the venue, the staff and the equipment accordingly, and follow the school's own rules while you are on site.
Respect each other
Harassment, discrimination, and abuse of any kind end a team's event immediately. Compete hard, but compete decently.
Report problems
If something is wrong — a broken challenge, an unsafe situation, a rule being abused — bring it to an organiser rather than handling it yourself.
Consequences. Depending on severity, breaches result in a warning, a points penalty, disqualification of the team, or removal from the venue. The organising team decides which applies, and that decision stands.
Scoring weights, tie-break rules and the project judging criteria will be added to this page as they are confirmed. The version number at the top of the page changes when they do.