A small field of teams works out of a single residence in Old San Juan from Friday noon to Monday evening — offense, defense, and a rolling capture-the-flag — then presents in person to a technical panel. One winner is named that night.
Fortaleza is deliberately small. There is no conference floor, no sponsor hall, and no two-minute demo slot. Participants live and work out of one residence in Old San Juan for the length of the event, with the judges and advisors in the room — at meals, at odd hours, and at the final table on Monday night.
The work is practical security. Teams break into purpose-built targets and document how; they read real traffic to find the intrusion already underway; they take custody of vulnerable code and make it defensible without breaking it; and they chip away at a capture-the-flag board that runs the length of the weekend.
Flights and lodging are covered for every confirmed participant. The event is built for people with genuine ability and curiosity in security, whatever the shape of their background — offensive, defensive, or engineering.
Teams fly into San Juan (SJU) and settle in at the house. Ground transport details are provided ahead of travel.
Challenge reveal, scope and rules of engagement, team check-in. Work begins immediately after.
The house is yours around the clock. Advisors hold informal office hours through the weekend.
Each team presents its findings and work to the panel. Results are announced the same evening.
Assessment of deliberately deployed target applications. Credit goes to findings that are clearly documented and cleanly reproducible.
injection · xss · auth bypass · csrf · api abuseAnalysis of captured traffic and logs to identify malicious activity and reconstruct how the intrusion unfolded.
traffic analysis · brute force · c2 detection · timelineCustody of a vulnerable codebase. Fixes are expected to hold up under scrutiny without breaking what works.
patching · auth hardening · encryption at rest & in transitA rolling problem board open for the duration of the event, scored on flags captured before the Monday deadline.
cryptanalysis · reverse engineering · forensics · stegoAwarded to the winning team as judged by the panel on Monday evening. Flights and lodging are covered for all confirmed participants, independent of results — the trip is not the consolation prize; it is the table stakes.
Working space, meals, and lodging under one roof, inside the walled city. Participants fly into Luis Muñoz Marín International (SJU), about twenty minutes away by taxi or rideshare. Puerto Rico is a U.S. territory — no passport required for U.S. citizens. Booking details are sent to confirmed participants.