WinterWorks / Exhibition pilot v0.1

Find the evidence.
Capture the flag.

Three small cybersecurity puzzles in a fictional support business. Work with synthetic files, explain what happened, and recommend how the system should be fixed.

100% offline puzzleSynthetic recordsNo live targetsNo login required
Download participant puzzle ZIPRead instructions
Exhibition / training prototype — not an official prize competition. This archive contains static text, CSV, and JSONL evidence only. There is no live hacking target, registration, funded award, or official deadline. The puzzle should be independently reviewed before a competitive event.
Three stages
01 · STARTER

Ghost Booking

Use booking records to find a fully paid customer whose request has fallen through an operational gap. Describe the workflow failure.

02 · INTERMEDIATE

Unlocked Ticket

Review a fictional support API access log. Locate a successful cross-account read and explain what authorization check failed.

03 · ADVANCED

The Helpful Agent

Review a synthetic AI assistant trace. Spot the untrusted instruction that crossed a tool-authorization boundary.

Getting started

Everything you need is in the ZIP

  1. Download the participant archive and extract it on your device.
  2. Read README.txt before attempting the tasks.
  3. Analyze bookings.csv, support_api_audit.jsonl, and agent_trace.txt.
  4. For each stage, provide one flag, one sentence of evidence, and one defensive recommendation.
  5. Keep your answers privately; do not post solutions publicly.

Use only the supplied synthetic evidence. Do not test campus networks, websites, real accounts, NOVARCH production systems, or any third-party device.

Organizer note

Designed for learning, not intrusion

These tasks illustrate operational monitoring, broken authorization, and prompt-injection boundaries without offering a vulnerable public service. A future hosted challenge requires separate infrastructure and organizer approval.