APort Vault · Terms & Conditions

You talk to AI bankers and try to convince them to transfer money out of a simulated bank account. Each level has a different persona with different defenses. APort’s policy engine sits behind the AI and blocks transfers that violate the rules — even if you fool the banker.

There are 5 levels, each with a turn limit:

• L1 · The Intern — 20 turns
• L2 · The Teller — 25 turns
• L3 · The Manager — 30 turns
• L4 · The Auditor — 35 turns
• L5 · The Vault — 30 turns

All money in the game is simulated. Balances reset every attempt.

This prize round is closed. The bounties below are no longer claimable. L3 and L4 were claimed; the $5,000 L5 bounty was never claimed and the round ended with it unclaimed. The table stays up as a record of what was offered, not as an open invitation.

Total prize pool: $6,500 USD. Prizes were first-blood only — the first person globally to clear a prize level won that bounty.

• You must authenticate with GitHub (type login in the game) to claim a prize.
• One winner per level, globally. If someone already claimed first blood, the bounty is gone.
• A valid email address (from your GitHub account) is required for payout.
• You don’t need to be logged in to play — but only GitHub-authenticated wins count. Unauthenticated level clears are not recorded on the leaderboard and are not eligible for prizes or first blood.

• Prizes are paid in USD via Chimoney.
• Payout is sent to the primary email on your GitHub account.
• L3 and L4 payouts are processed automatically on level clear.
• L5 has a 24-hour manual review period before payout is sent.
• If your GitHub account has no verified email, we can’t pay you. Make sure your email is set.

• Anonymous device fingerprint — a SHA-256 hash of browser signals. Not PII. Used to tie sessions together and enforce fair play.
• GitHub profile (if you auth) — username, avatar URL, and primary email. Used for leaderboard display and prize payout.
• Attempt logs — your conversation turns, APort decisions, and level outcomes. Anonymized and used for security research.
• IP address — used for rate limiting only. Not stored long-term.

We don’t sell your data. We don’t run ads. This is a security demo, not a data harvesting operation.

• 5 messages per minute rate limit per device.
• 30-second cooldown between attempt resets.
• No automation, scripting, or botting. Play by hand.
• One account per device. Multi-accounting to bypass rate limits = disqualification.
• Don’t attack the infrastructure. This is a prompt-injection CTF, not a pentesting engagement.

Level 5 (“The Vault”) is intentionally designed to be near-impossible. It exists as a security demonstration: APort’s policy engine blocks transfers at the infrastructure level, regardless of what the AI says. The $5,000 bounty is real, but the security controls are designed to make it extremely difficult to claim. That’s the point.

All account balances in the game are completely fake. Each level has its own starting balance that resets every attempt. No real funds are held, moved, or at risk during gameplay. The only real money involved is the prize pool paid out to first-blood winners.

• APort reserves the right to modify these rules, disqualify abusive players, or pause the CTF at any time.
• The game is provided as-is, no warranty. Things might break.
• Prize payouts are subject to Chimoney availability and processing. We’ll do our best.
• If we detect abuse (automation, multi-accounting, infrastructure attacks), we may ban your device fingerprint without notice.
• These terms may be updated. Check back if you’re unsure.

Questions, disputes, or just want to say hi: aport.io