NOVARCH // WINTERWORKS // OFFLINE SECURITY MINI-CTF (EXHIBITION PILOT)
Version 0.1 | 12 October 2026 | NOT the official prize competition

SCOPE AND RULES
This is an offline evidence-analysis exercise using invented data only.
You may inspect the three included files with a text editor, spreadsheet,
or your own local scripts. You do not need to connect to any service.
Never test real websites, campus systems, cafe equipment or personal accounts.
The organizer must review this prototype and test it independently before use.

STORY
WinterWorks is a fictional small business. Someone has been losing bookings,
a support API may have an authorization weakness, and an assistant may be
following instructions embedded in a support ticket.

TASK 1 - GHOST BOOKING (starter)
Open bookings.csv. Identify the *one* fully paid booking that has been waiting
unassigned for over 48 hours at the fictional audit time 2026-10-16T18:00:00Z.
Capture the identifier and explain the workflow failure.
Flag format: NOVARCH{<booking_id>-UNASSIGNED}

TASK 2 - UNLOCKED TICKET (intermediate)
Open support_api_audit.jsonl. Find the one successful ticket-read request in
which the requesting account did not own the ticket. Explain why an HTTP 200
instead of a 403 would indicate an authorization flaw in this fictional API.
Flag format: NOVARCH{<ticket_id>-CROSS-TENANT}

TASK 3 - THE HELPFUL AGENT (advanced reasoning)
Open agent_trace.txt. Find the untrusted source that caused an inappropriate
money-related tool action. The key is the trust boundary: data from a ticket
must not override system policy or authorize a tool call.
Flag format: NOVARCH{<source>-<tool_action>}
Use the uppercase shorthand labels shown in the evidence fields.

FOR EACH TASK
Write one flag, one sentence describing the evidence and one sentence about
how to prevent recurrence. This is a training game, not a vulnerability report.

SCORING FOR THIS PILOT
One correct flag per task, plus clear explanation and defensive suggestion.
The official #HACKTHEFLAG 01 event, prizes, judge rubric and dates require a
separately approved participant brief; this ZIP does NOT establish them.
