About
A website that lies to you, on purpose
404 FOUND is a competitive treasure hunt that takes place inside a deliberately strange website. Somewhere in it are broken interfaces, suspicious pixels, hidden messages, and behaviours that make sense only once you understand what the browser is actually doing.
You will not be told how many there are. You will only ever see how many you have verified. That uncertainty is deliberate: it is the difference between finishing a checklist and actually exploring.
Underneath the game is a straightforward idea. Building websites teaches you how things should work. Debugging teaches you how they actually work. Most students graduate having done a great deal of the first and almost none of the second.
What is real
- Your account, session and password handling
- The competition timer and the leaderboard
- Report submission and review
- Everything under /hunt and /admin
What is fiction
- Every product, price and shipping estimate in ByteMart
- Every image, caption and statistic in the arena
- Every demo form, profile and notification
- Every API under /api/game
A note on safety
This application looks hackable. It is not. There is no real SQL injection, no stored or reflected XSS, no CSRF hole, no IDOR and no authentication bypass anywhere in it. Passwords are hashed with Argon2id, sessions are opaque tokens in HttpOnly cookies, and every authorisation decision is made on the server against the database.
Every planted defect lives inside a game surface built on synthetic data. If you find something that looks like a real vulnerability, that is a genuine finding and we want to hear about it — through the report form, not through an exploit.