Inspiration
I have a passion for cybersecurity, and was a part of the cybersecurity club at my school, where we participated in live competitions like Lockheed Martin's Cyberquest and PicoCTF. One of the biggest challenges with training was consistency. We only met once a week, and not everyone practiced at home.
Another one of my favorite things recently has been daily puzzle games. Wordle, Connections, and Minute Cryptic have become part of my daily routine. Combining these two interests led me to create flag.exe: a way to make cybersecurity a fun daily habit.
What it does
flag.ctf is a daily-cybersecurity puzzle game. When opening the site, it presents you with 2 new challenges every day, ranging from easy-hard. Challenges involve decoding messages, investigating logs, and inspecting digital evidence. The hackathon prototype has six challenges across three days.
Players can reveal hits, submit answers, and learn from explanations after solving each challenge. Once both challenges are completed, a results screen shows how well you did and gives you a shareable emoji scorecard to send to your friends. Progress automatically saves in browser, with no account required.
How we built it
I built flag.exe with Next.js, React, TypeScript, and CSS, using OpenAI Codex as an AI coding assistant. I developed the concept and guided the features, visual direction, and revisions throughout the project.
I chose a retro desktop aesthetic and shaped the experience around two daily cybersecurity challenges. I sourced challenge material from Lockheed Martin cyber quest Academy to give the prototype multiple days of content. The prototype uses a small challenge bank, server-side answer checking, and browser storage to save progress without requiring an account.
I built the app step by step: I reviewed the working app, requested changes, and refined features such as the hints, demo-day controls, and shareable results showing attempts and hints used. Codex helped implement and debug the code, while I directed what we built and how the pieces should work together.
Challenges we ran into
I had a strong idea coming into the project, but wasn't fully sure how I would build it and what it would look like. As a first-year hackathon, I wasn't sure how the pieces of web development would fit together. It took a lot of prototypes before I landed on the aesthetic and gameplay loop that exists now.
Another challenge was figuring out what types of challenges would fit in the game. A lot of CTF challenges involve downloading files, using outside applications like nmap and wireshark, or even entering virtual machines. I decided to balance between difficulty and ease of access by having all files visible in the browser, making the game approachable to all levels.
Accomplishments that we're proud of
All in all, I’m proud that I turned an idea connecting two of my interests into a working game at my first hackathon. It has a visual style I’m happy with and enough content to show how the daily experience could work.
What we learned
I learned how the different parts of a web app work together: the interface presents the challenges, the server checks answers, and browser storage remembers progress. I also became more familiar with GitHub and how it fits into building and saving a project.
Working with an AI coding assistant taught me to break ideas into specific requests, review the results, and make changes based on what actually worked. I didn’t need to know everything before starting, but I still needed to make decisions about the experience I wanted to create.
I also learned that choosing good challenges is just as important as building the game around them. A challenge needs to be interesting and educational, but short and approachable enough that someone wants to come back tomorrow.
What's next for Flag.exe
I would love to publish flag.exe as a full game available to anyone. The biggest issue in turning it into a real product is having a database of questions. It would be difficult to create challenges every day that are unique, applicable to real-world cyber security scenarios, and have a good amount of content to work through.
Log in or sign up for Devpost to join the conversation.