The grand finale.
✅ This week — what to do
- Before class — project report + demo video link submitted (see below); team ready for the CTF.
- In class (240 min) — Capstone CTF tournament (
ctf.md, whole term); the instructor may call a team aside for a short project Q&A. - Submit — final project + report (see project/README.md).
Time breakdown: AGENDA.md (../../AGENDA.md).
🏆 Capstone CTF Tournament
A full capture-the-flag covering the whole term — 14 challenges, 165 pts across web, API, memory safety, supply chain, cloud, LLM/agentic and DevSecOps. Team-based, leaderboard, prizes.
Final Project Demos
Each team's video walks through their secured build end-to-end:
- Threat model → vulnerabilities found → remediation
- SBOM + signed artifact
- Security CI/CD pipeline
- Submit the recorded video walkthrough as an unlisted link in your report, due with the report (graded asynchronously on the rubric). No per-team live slot — the instructor may call any team for a short live Q&A on its own work
Bring
Everything from the term project: threat model, vuln report (CWE/OWASP mapped), fixed code, SBOM, signed artifact, CI pipeline.
References
- All prior weeks + https://owasp.org/Top10/2025/