Forge your wins.
PwnForge is a collaborative platform for CTF teams and offensive security professionals, built for teams that actually compete, not for organizers. It replaces the usual improvised stack of Notion, Discord, and Google Sheets with a single tool designed around how CTF teams actually work: challenges, writeups, notes, and real-time collaboration in one place.
Self-hostable, and built to scale from a solo player to a full team.
- Workspaces: one workspace per CTF or platform, solo or team, with granular permissions
- Challenges & tags: system and custom tags, status tracking, assignment, attachments, private notes
- Writeups: Markdown split-pane editor, draft or published, per-team visibility
- Teams & invitations: expirable invite links, role-based access, multi-workspace membership
- Real-time collaboration: WebSocket-backed updates across the team
- Stats & activity feed: track solves, progress, and team activity over time
- Backend: Rust, Axum, SeaORM, PostgreSQL, Redis
- Frontend: React, TypeScript, Vite, Tailwind CSS, shadcn/ui
- Infra: Docker Compose, WebSockets
git clone https://github.com/getpwnforge/pwnforge.git
cd pwnforge
cp .env.example .env
docker compose up -dImportant:
docker-compose.ymlis the production configuration. It pulls pre-built images from GHCR and does not reflect local source changes. If you're contributing code or want hot-reload, usedocker-compose.dev.ymlinstead (see CONTRIBUTING.md).
This repository is complete and free to self-host, licensed under the AGPL v3, nothing held back behind a separate build. A managed cloud instance is also available at pwnforge.app if you'd rather not run the infrastructure yourself.
Contributions are welcome. See CONTRIBUTING.md for setup instructions and our DCO-based contribution process (no CLA; pseudonyms accepted, valid email required).
Thanks to everyone who has contributed to PwnForge:
Found a vulnerability? Please see SECURITY.md for responsible disclosure instructions. Do not open a public issue.
PwnForge is licensed under the GNU AGPL v3.