Flags Coming soon
A flag is proof that a defect is real: a value you could only be holding if you actually reached it.
A flag exists where the proof of a vulnerability is something you can carry away. Where the proof is an effect instead — a script that ran, a session that survived, a table that emptied — there is nothing to put in one, so not every exercise has a flag to find. That asymmetry is the design rather than a gap.
State
Nothing to check yet
This page will be where you paste a flag and find out whether it is one. It is empty for a plain reason: the applications whose flags it would check have not been built. Insecurity BBS is finished, and its flags are checked by its own scorer — run beside the board, which is where a work sheet tells you to run it. The applications after it are what this page is for, and they are still declared rather than written.
So this is a menu entry standing open for something, and the honest state of it is that there is nothing behind it. There is no date. When there are flags to check, the check will be here and the address will not change.
Meanwhile
Where a flag gets checked today
Beside the application, by the scorer it ships with. Each repository carries one, each work sheet names it, and it is the thing that knows the answers — not this site. A page on a static site cannot keep a secret from the browser it is sent to, so whatever lands here will be built to suit that rather than to pretend otherwise.