$ cat writeup.md…
$ cat writeup.md…
uoftctf2026
A Node.js/Express web application with user registration, login, blog posts, and magic links for passwordless login. An admin bot (Puppeteer) visits reported URLs after logging in as admin. The `/flag` endpoint is only accessible to admin users.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar