tool 02 · capture-the-flag
vibecoded.fail
It shipped. It works. It's broken. Find where.
- type
- 9-level web CTF
- for
- vibe coders + appsec
- scoring
- slop{...} flags, timed
- the board
- finishers only, top 10
- difficulty
- easy to medium
01 · what it is
vibecoded.fail is a 9-level web security CTF where every level is an AI startup that shipped a real vulnerability. Solve a level and you unlock the thing that makes it click: a faked AI coding transcript of the conversation that produced the bug. The vuln is the puzzle. The transcript is the point.
It's built for the people on both ends of the problem: the ones shipping AI-written code and the ones trying to secure it.
The thesis the whole thing argues: the bug isn't the AI being dumb. It's that nobody read what it wrote.
two ways to play
Vibe mode is practice: hints on, untimed, nothing posts to the board. Raw mode is the real run: no hints, timed from the moment you start and the only path that ranks. The split is deliberate. Vibe is for learning the failure modes. Raw is for proving you can find them cold.
02 · how it plays
You land on what looks like a real, shipped AI startup. Slick landing page, confident copy, the usual launch-day gloss. Except it's broken, and your job is to find where.
Pick your track. Vibe if you want hints and a practice run, raw if you want the timed, no-help version that counts.
Then you do what a security review actually looks like: poke at the surface, read what's there, notice the thing that shouldn't be. When you find the vulnerability, you capture its flag and submit it inline on the level itself.
A correct flag opens the reveal: the faked AI coding transcript that "wrote" the bug, where the builder hits some friction, tells the AI to just make it work and the AI takes the lazy path and ships it. Alongside it, the lesson and the real-world incident the level is based on. Then the next level unlocks.
Clear all nine in raw mode and you've earned a spot on the board. Most don't get there.
a look inside
Every level is grounded in a failure that has actually shipped in the wild. The difficulty climbs the whole way. The first level is a recognition test: you either see it or you learn to look. The capstone rewards everything you picked up getting there.
start