CTF Flashcards

All projects · Cybersecurity Lab · About Matt

Live on Cloudflare. Built for RevenueCat's Shipaton 2026 hackathon (Next Gen student award). Designed and directed by me, implemented with AI pair programming.

Description

What it does: A cybersecurity active-recall app built around a single idea — the puzzles fuel the questions. You solve HackTheBox-style CTF puzzles (decode a cipher, crack a hash, spot the bug), and each flag you capture drops the concepts behind it into your review deck as flashcards. Every review is free recall — you type your answer before seeing it, self-rate Again / Hard / Good / Easy, and the card is rescheduled by FSRS, the modern successor to Anki's SM-2, so cards you struggle with come back in minutes and easy ones in weeks.

The AI Learn tab: Name any topic — SQL injection, JWT attacks, buffer overflows — and an AI tutor writes flashcards for it, generates practice challenges, and produces a downloadable lab kit. The challenges stay locked until you've reviewed every flashcard for that topic: learn first, then prove it. Puzzle solvability is guaranteed because the Worker renders the challenge artifact deterministically (base64 / hex / XOR / Caesar / binary / reverse) rather than trusting the model to be consistent.

How it was built: Production is entirely on Cloudflare — a React + Vite frontend on Pages, and a backend Worker on D1 that runs the FSRS scheduler (ts-fsrs) and renders puzzles. A FastAPI + Python backend is kept as a 1:1 local-dev twin of the Worker. The catalog is shared across a web build and Capacitor mobile shells. Free tier is 3 puzzle solves a day; Pro ($8/mo, paid as USDC on Base) is sold through my existing GRID Store billing worker. An optional, opt-in local Python monitor can turn things you look up into review cards.

Architecture

CTF Flashcards — Solve → Unlock → Recall ═══════════════════════════════════════════ Solve a CTF puzzle AI Learn tab (Groq) (base64 · XOR · JWT ──► name a topic ──► AI writes cards alg:none · hash · SQLi) + practice challenges │ (locked until cards reviewed) │ capture the flag │ ▼ ▼ concept cards drop into ◄─────────────── deterministic puzzle your review deck render (Worker) │ ▼ ┌─────────────────────────────┐ │ FSRS scheduler (ts-fsrs) │ free recall: type answer, │ Again · Hard · Good · Easy │ self-rate, reschedule └─────────────────────────────┘ │ filter reviews by topic (crypto · web · forensics · hashes) ▼ Cloudflare: Pages (React) + Worker on D1 · billing via GRID Store Python/FastAPI backend kept as a 1:1 local-dev twin

Dev Notes

Problem Solved

Security concepts don't stick from reading alone. This closes the loop: you earn a flashcard by actually solving the thing it describes, then spaced repetition makes sure you keep it.

Technical Highlights

FSRS scheduling in a Cloudflare Worker on D1, with a FastAPI Python twin kept 1:1 for local dev. AI-generated challenges are made guaranteed-solvable by having the Worker render the artifact deterministically instead of trusting the model's output.

What's Next

More puzzle categories, richer per-topic analytics, and polishing the Capacitor mobile shells that share the web catalog.

Try the live app · View source on GitHub