diff --git a/.gitignore b/.gitignore
index 1dc4bb2..bc7c8f4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -46,6 +46,8 @@ static/crackme/*
 static/solution/*
 !static/crackme/.gitkeep
 !static/solution/.gitkeep
+# Private source archives for auto-validated crackmes (reviewers only)
+private/
 config/config.json
 users.json
 .env
diff --git a/app/controllers/comment.py b/app/controllers/comment.py
index bd34700..0e93576 100644
--- a/app/controllers/comment.py
+++ b/app/controllers/comment.py
@@ -9,7 +9,9 @@
 import bleach
 from app.models.comment import comment_create, comment_by_id, comment_set_spoiler, get_thread_participants
 from app.models.solution import get_solution_authors
-from app.models.crackme import crackme_by_hexid, crackme_increment_comments
+from app.models.crackme import (
+    crackme_by_hexid, crackme_increment_comments, crackme_is_auto_validated
+)
 from app.models.notification import notification_add
 from app.models.errors import ErrNoResult
 from app.services.recaptcha import verify as verify_recaptcha
@@ -51,6 +53,23 @@ def leave_comment(hexid):
     """Post a comment on a crackme."""
     username = session.get('name')
 
+    try:
+        crackme = crackme_by_hexid(hexid)
+    except ErrNoResult:
+        flash('Crackme not found.', FLASH_ERROR)
+        return redirect(f'/crackme/{hexid}')
+    except Exception as e:
+        print(f"Error getting crackme: {e}")
+        flash('Comment creation failed. Please try again later.', FLASH_ERROR)
+        return redirect(f'/crackme/{hexid}')
+
+    if crackme_is_auto_validated(crackme):
+        flash(
+            'Comments are disabled for auto-validated crackmes.',
+            FLASH_ERROR
+        )
+        return redirect(f'/crackme/{hexid}')
+
     # Validate required fields
     is_valid, missing = validate_required(request.form, ['comment'])
     if not is_valid:
@@ -92,7 +111,6 @@ def leave_comment(hexid):
 
     # Send notification to crackme author and handle @mentions
     try:
-        crackme = crackme_by_hexid(hexid)
         crackme_author = crackme.get('author')
         crackme_name = crackme['name']
 
diff --git a/app/controllers/crackme.py b/app/controllers/crackme.py
index 4675007..f87b4d4 100644
--- a/app/controllers/crackme.py
+++ b/app/controllers/crackme.py
@@ -4,14 +4,14 @@
 
 import os
 from html import escape as html_escape
-from flask import Blueprint, render_template, request, redirect, flash, session, abort
+from flask import Blueprint, render_template, request, redirect, flash, jsonify, session, abort
 from werkzeug.utils import secure_filename
 import bleach
 from app.models.crackme import (
     crackme_by_hexid, last_crackmes, crackme_create_prepare,
     crackme_insert, crackme_delete_by_hexid, crackme_by_user_and_name,
     crackme_update_difficulty, crackme_update_quality, crackme_increment_downloads,
-    crackme_update
+    crackme_update, crackme_is_auto_validated
 )
 from app.models.solution import solutions_by_crackme
 from app.models.comment import comments_by_crackme
@@ -20,19 +20,39 @@
 from app.models.label_request import (
     label_request_create, pending_label_requests_by_user_and_crackme
 )
+from app.models.solve import (
+    solve_by_user_and_crackme, solve_create, count_solves_by_crackme,
+    solves_by_crackme
+)
+from app.models.flag_submission import (
+    flag_submission_create, count_flag_submissions_by_crackme
+)
+from app.models.user import user_by_name, users_by_hexids
 from app.models.errors import ErrNoResult
 from app.services.recaptcha import verify as verify_recaptcha
-from app.services.limiter import limit
-from app.services.view import FLASH_ERROR, FLASH_SUCCESS, validate_required
+from app.services.limiter import configured_limit, limit
+from app.services.view import FLASH_ERROR, FLASH_SUCCESS, FLASH_NOTICE, validate_required
 from app.services.labels import get_label_groups, get_dataset_url, normalize_labels
-from app.services.archive import is_archive_password_protected, is_single_file_archive, is_unsupported_archive
-from app.services.discord import notify_new_crackme
+from app.services.archive import (
+    is_archive_password_protected, is_single_file_archive,
+    is_unsupported_archive, is_zip_archive,
+)
+from app.services.discord import (
+    notify_flag_solved, notify_flag_submission, notify_new_crackme
+)
+from app.services.flag import (
+    FLAG_FORMAT_HINT, flags_match, is_valid_flag_format, normalize_flag
+)
+from app.services.points import points_for_solve, solve_difficulty
 from app.controllers.decorators import login_required
 
 crackme_bp = Blueprint('crackme', __name__)
 
 # Upload folder for crackmes
 UPLOAD_FOLDER = 'tmp/crackme'
+# Source archives for auto-validated crackmes. Never served: this directory sits
+# outside static/ so the only way to read one is the reviewer download route.
+SOURCE_UPLOAD_FOLDER = 'private/crackme_source'
 MAX_FILE_SIZE = 10 * 1024 * 1024  # 10MB
 
 
@@ -57,6 +77,35 @@ def crackme_view(hexid):
     # Get current user for edit permission check
     usersess = session.get('name')
 
+    # Flag submission panel. Only auto-validated crackmes pay for these extra
+    # queries; everything else renders exactly as before.
+    auto_validation = crackme_is_auto_validated(crackme)
+    nbsolves = 0
+    nbattempts = 0
+    solves = []
+    user_solve = None
+    if auto_validation:
+        try:
+            nbsolves = count_solves_by_crackme(hexid)
+            nbattempts = count_flag_submissions_by_crackme(hexid)
+            solve_records = solves_by_crackme(hexid)
+            solvers = users_by_hexids(
+                solve['user_hexid'] for solve in solve_records
+            )
+            solves = [
+                {
+                    'solve': solve,
+                    'username': solvers.get(solve['user_hexid'], {})
+                                       .get('name', 'Deleted user'),
+                }
+                for solve in solve_records
+            ]
+            viewer_hexid = _user_hexid(usersess) if usersess else None
+            if viewer_hexid:
+                user_solve = solve_by_user_and_crackme(viewer_hexid, hexid)
+        except Exception as e:
+            print(f"Error getting solve data: {e}")
+
     # Build mention targets for @mention autocomplete (author + commenters + solution authors)
     mention_targets = {crackme.get('author', '')}
     for comment in comments:
@@ -87,9 +136,29 @@ def crackme_view(hexid):
                            labels=crackme.get('labels', []),
                            label_groups=get_label_groups(),
                            labels_dataset_url=get_dataset_url(),
+                           auto_validation=auto_validation,
+                           nbsolves=nbsolves,
+                           nbattempts=nbattempts,
+                           solves=solves,
+                           user_solve=user_solve,
+                           solve_points=points_for_solve(crackme) if auto_validation else 0,
+                           flag_format_hint=FLAG_FORMAT_HINT,
                            usersess=usersess)
 
 
+def _user_hexid(username):
+    """Resolve a username to the immutable id solves are keyed by.
+
+    Returns None when the user can't be resolved, which callers treat as "no
+    solve" rather than an error.
+    """
+    try:
+        user = user_by_name(username)
+    except Exception:
+        return None
+    return user.get('hexid') or str(user['_id'])
+
+
 @crackme_bp.route('/lasts')
 def last_crackmes_redirect():
     """Redirect /lasts to /lasts/1."""
@@ -144,6 +213,48 @@ def upload_crackme_get():
     return render_template('crackme/create.html', label_groups=get_label_groups())
 
 
+def _upload_rejected(message):
+    """Reject an upload without throwing away what the user typed.
+
+    An AJAX submission gets the message as JSON and the browser keeps the page
+    (and the files the user picked) untouched; a plain form post falls back to
+    re-rendering the form with the submitted values filled back in. Either way a
+    single missing field no longer costs someone the whole form.
+    """
+    if _wants_json():
+        return jsonify({'ok': False, 'error': message}), 400
+
+    flash(message, FLASH_ERROR)
+    return render_template('crackme/create.html',
+                           label_groups=get_label_groups(),
+                           form=_submitted_form_values())
+
+
+def _wants_json():
+    """True when the upload form posted in the background rather than navigating."""
+    return request.headers.get('X-Requested-With') == 'XMLHttpRequest'
+
+
+def _submitted_form_values():
+    """The submitted values, shaped for re-rendering the upload form.
+
+    File inputs are deliberately absent: browsers won't let a server refill them,
+    which is exactly why the form posts over fetch when it can.
+    """
+    return {
+        'name': request.form.get('name', ''),
+        'info': request.form.get('info', ''),
+        'lang': request.form.get('lang', ''),
+        'arch': request.form.get('arch', ''),
+        'platform': request.form.get('platform', ''),
+        'difficulty': request.form.get('difficulty', ''),
+        'labels': normalize_labels(request.form.getlist('labels')),
+        'auto_validation': bool(request.form.get('auto_validation')),
+        'flag': request.form.get('flag', ''),
+        'points': request.form.get('points', ''),
+    }
+
+
 @crackme_bp.route('/upload/crackme', methods=['POST'])
 @login_required
 @limit("10 per day", key_func=lambda: session.get('name'))
@@ -155,8 +266,7 @@ def upload_crackme_post():
     required = ['name', 'info', 'lang', 'difficulty', 'platform', 'arch']
     is_valid, missing = validate_required(request.form, required)
     if not is_valid:
-        flash(f'Field missing: {missing}', FLASH_ERROR)
-        return render_template('crackme/create.html', label_groups=get_label_groups())
+        return _upload_rejected(f'Field missing: {missing}')
 
     name = bleach.clean(request.form.get('name', ''))
     info = bleach.clean(request.form.get('info', ''))
@@ -174,46 +284,74 @@ def upload_crackme_post():
         if diff_int < 1 or diff_int > 6:
             raise ValueError()
     except (ValueError, TypeError):
-        flash('Wrong difficulty', FLASH_ERROR)
-        return render_template('crackme/create.html', label_groups=get_label_groups())
+        return _upload_rejected('Wrong difficulty')
 
     # Validate reCAPTCHA
     if not verify_recaptcha(request):
-        flash('reCAPTCHA invalid!', FLASH_ERROR)
-        return render_template('crackme/create.html', label_groups=get_label_groups())
+        return _upload_rejected('reCAPTCHA invalid!')
 
     # Check for file
     if 'file' not in request.files:
-        flash('Field missing: file', FLASH_ERROR)
-        return render_template('crackme/create.html', label_groups=get_label_groups())
+        return _upload_rejected('Field missing: file')
 
     file = request.files['file']
     if file.filename == '':
-        flash('Field missing: file', FLASH_ERROR)
-        return render_template('crackme/create.html', label_groups=get_label_groups())
+        return _upload_rejected('Field missing: file')
 
     # Read file data
     file_data = file.read()
 
     # Check file size
     if len(file_data) > MAX_FILE_SIZE:
-        flash('This file is too large!', FLASH_ERROR)
-        return render_template('crackme/create.html', label_groups=get_label_groups())
+        return _upload_rejected('This file is too large!')
 
     # Check for unsupported archive formats (RAR, tar, etc.)
     if is_unsupported_archive(file_data):
-        flash('RAR and tar archives are not supported. Please upload a ZIP file for multiple files, or upload single files directly.', FLASH_ERROR)
-        return render_template('crackme/create.html', label_groups=get_label_groups())
+        return _upload_rejected('RAR and tar archives are not supported. Please upload a ZIP file for multiple files, or upload single files directly.')
 
     # Check for password protection
     if is_archive_password_protected(file_data):
-        flash('Password-protected archives are not allowed. Do NOT add a password yourself - the server handles this automatically.', FLASH_ERROR)
-        return render_template('crackme/create.html', label_groups=get_label_groups())
+        return _upload_rejected('Password-protected archives are not allowed. Do NOT add a password yourself - the server handles this automatically.')
 
     # Check for single-file archives
     if is_single_file_archive(file_data):
-        flash('Archives containing only one file are not allowed. Please upload the file directly without wrapping it in an archive.', FLASH_ERROR)
-        return render_template('crackme/create.html', label_groups=get_label_groups())
+        return _upload_rejected('Archives containing only one file are not allowed. Please upload the file directly without wrapping it in an archive.')
+
+    # Auto-validation opt-in: the flag users will submit, plus the private source
+    # archive a reviewer needs to confirm that flag is actually the right one.
+    flag = None
+    source_data = None
+    source_filename = None
+    official_difficulty = None
+    if request.form.get('auto_validation'):
+        flag = normalize_flag(request.form.get('flag', ''))
+        if not is_valid_flag_format(flag):
+            return _upload_rejected(f'Invalid flag format. {FLAG_FORMAT_HINT}')
+
+        points_value = request.form.get('points') or str(diff_int * 100)
+        try:
+            points = int(points_value)
+        except (TypeError, ValueError):
+            return _upload_rejected('Points must be a whole number from 100 to 600.')
+        if points < 100 or points > 600:
+            return _upload_rejected('Points must be a whole number from 100 to 600.')
+        official_difficulty = points / 100
+
+        source = request.files.get('source')
+        if source is None or source.filename == '':
+            return _upload_rejected('Auto-validation needs a source archive so reviewers can verify the flag.')
+
+        source_data = source.read()
+        if len(source_data) > MAX_FILE_SIZE:
+            return _upload_rejected('The source archive is too large!')
+        if is_unsupported_archive(source_data):
+            return _upload_rejected('RAR and tar source archives are not supported. Please upload a ZIP file.')
+        if not is_zip_archive(source_data):
+            return _upload_rejected('The reviewer verification file must be a valid ZIP archive.')
+        if is_archive_password_protected(source_data):
+            return _upload_rejected('Password-protected source archives are not allowed - reviewers need to be able to open it.')
+
+        source_filename = secure_filename(source.filename) or "source"
 
     # Store the uploaded file size
     size = len(file_data)
@@ -221,8 +359,7 @@ def upload_crackme_post():
     # Check for duplicate pending submission
     try:
         crackme_by_user_and_name(username, name, visible=False)
-        flash('You already have a pending crackme with this name. Please wait for review or choose a different name.', FLASH_ERROR)
-        return render_template('crackme/create.html', label_groups=get_label_groups())
+        return _upload_rejected('You already have a pending crackme with this name. Please wait for review or choose a different name.')
     except ErrNoResult:
         pass  # No duplicate, continue
 
@@ -231,13 +368,17 @@ def upload_crackme_post():
 
     # Prepare crackme
     try:
-        crackme = crackme_create_prepare(name, info, username, lang, arch, platform, size, original_filename, labels=labels)
+        crackme = crackme_create_prepare(name, info, username, lang, arch, platform, size, original_filename,
+                                         labels=labels, flag=flag,
+                                         source_original_filename=source_filename,
+                                         official_difficulty=official_difficulty)
     except Exception as e:
         print(f"Error preparing crackme: {e}")
         abort(500)
 
     # Create path using hexid only
     safe_path = os.path.join(UPLOAD_FOLDER, crackme['hexid'])
+    source_path = os.path.join(SOURCE_UPLOAD_FOLDER, crackme['hexid'])
 
     # Ensure upload directory exists
     os.makedirs(UPLOAD_FOLDER, exist_ok=True)
@@ -248,15 +389,32 @@ def upload_crackme_post():
             f.write(file_data)
     except Exception as e:
         print(f"File write error: {e}")
-        flash('Failed to save file. Please try again.', FLASH_ERROR)
-        return render_template('crackme/create.html', label_groups=get_label_groups())
+        return _upload_rejected('Failed to save file. Please try again.')
+
+    if source_data is not None:
+        try:
+            os.makedirs(SOURCE_UPLOAD_FOLDER, exist_ok=True)
+            with open(source_path, 'wb') as f:
+                f.write(source_data)
+        except Exception as e:
+            print(f"Source file write error: {e}")
+            os.remove(safe_path)
+            return _upload_rejected('Failed to save the source archive. Please try again.')
+
+    def _cleanup_files():
+        for path in (safe_path, source_path if source_data is not None else None):
+            if path:
+                try:
+                    os.remove(path)
+                except OSError:
+                    pass
 
     # Insert crackme into database
     try:
         crackme_insert(crackme)
     except Exception as e:
         print(f"Database insert error: {e}")
-        os.remove(safe_path)  # Cleanup
+        _cleanup_files()  # Cleanup
         abort(500)
 
     # Create ratings
@@ -265,7 +423,7 @@ def upload_crackme_post():
         rating_quality_create(username, crackme['hexid'], 4)
     except Exception as e:
         print(f"Rating creation error: {e}")
-        os.remove(safe_path)
+        _cleanup_files()
         crackme_delete_by_hexid(crackme['hexid'])
         rating_difficulty_delete_by_crackme(crackme['hexid'])
         abort(500)
@@ -289,10 +447,127 @@ def upload_crackme_post():
     except Exception as e:
         print(f"Discord notification error: {e}")
 
+    # Post/redirect/get: the confirmation lives at its own URL, so the browser
+    # (and the background submit above, which just follows the redirect) can't
+    # re-post the upload by refreshing.
+    session['submitted_crackme'] = crackme['name']
+    if _wants_json():
+        return jsonify({'ok': True, 'redirect': '/upload/crackme/submitted'})
+    return redirect('/upload/crackme/submitted')
+
+
+@crackme_bp.route('/upload/crackme/submitted', methods=['GET'])
+@login_required
+def upload_crackme_submitted():
+    """Confirm a crackme upload that just went through."""
+    name = session.pop('submitted_crackme', None)
+    if not name:
+        return redirect('/upload/crackme')
+
     return render_template('submission/success.html',
                            submission_type='Crackme',
-                           name=crackme['name'],
-                           username=username)
+                           name=name,
+                           username=session.get('name'))
+
+
+@crackme_bp.route('/crackme/<hexid>/solve', methods=['POST'])
+@login_required
+# Guessing a flag is meant to be impossible, but a slow attempt rate makes that
+# true even for a badly chosen flag.
+@limit(configured_limit('FlagSubmissions'), key_func=lambda: session.get('name'))
+def submit_flag(hexid):
+    """Validate a submitted flag and, if correct, record the solve."""
+    username = session.get('name')
+    flag = normalize_flag(request.form.get('flag', ''))
+
+    def log_result(result, user_hexid=None):
+        """Persist the submitted flag and its validation outcome."""
+        try:
+            flag_submission_create(
+                user_hexid, username, hexid, flag, result
+            )
+        except Exception as e:
+            # Audit logging must not turn a validation response into a 500.
+            print(f"Error logging flag submission: {e}")
+        try:
+            notify_flag_submission(
+                username, crackme.get('name', ''), hexid, flag, result
+            )
+        except Exception as e:
+            # Discord must never affect validation or its database audit trail.
+            print(f"Discord flag-audit notification error: {e}")
+
+    try:
+        crackme = crackme_by_hexid(hexid)
+    except ErrNoResult:
+        abort(404)
+    except Exception as e:
+        print(f"Error getting crackme: {e}")
+        abort(500)
+
+    if not crackme_is_auto_validated(crackme):
+        log_result('not_enabled')
+        flash('This crackme does not accept flag submissions.', FLASH_ERROR)
+        return redirect(f'/crackme/{hexid}')
+
+    # Authors already know their own flag; awarding them points for it would
+    # make the scoreboard meaningless.
+    if crackme.get('author') == username:
+        log_result('own_crackme')
+        flash("You can't submit a flag for your own crackme.", FLASH_ERROR)
+        return redirect(f'/crackme/{hexid}')
+
+    user_hexid = _user_hexid(username)
+    if not user_hexid:
+        log_result('account_unavailable')
+        flash('Could not verify your account. Please log in again.', FLASH_ERROR)
+        return redirect(f'/crackme/{hexid}')
+
+    try:
+        if solve_by_user_and_crackme(user_hexid, hexid):
+            log_result('already_solved', user_hexid)
+            flash('You have already solved this crackme.', FLASH_NOTICE)
+            return redirect(f'/crackme/{hexid}')
+    except Exception as e:
+        print(f"Error checking existing solve: {e}")
+        abort(500)
+
+    if not is_valid_flag_format(flag):
+        log_result('invalid_format', user_hexid)
+        flash(f'That is not a valid flag. {FLAG_FORMAT_HINT}', FLASH_ERROR)
+        return redirect(f'/crackme/{hexid}')
+
+    if not flags_match(crackme.get('flag'), flag):
+        log_result('incorrect', user_hexid)
+        flash('Wrong flag. Keep trying!', FLASH_ERROR)
+        return redirect(f'/crackme/{hexid}')
+
+    points = points_for_solve(crackme)
+    try:
+        solve_create(user_hexid, hexid, points, solve_difficulty(crackme))
+    except Exception as e:
+        print(f"Error recording solve: {e}")
+        abort(500)
+
+    log_result('correct', user_hexid)
+
+    try:
+        notify_flag_solved(
+            username, crackme.get('name', ''), hexid, points
+        )
+    except Exception as e:
+        print(f"Discord solve notification error: {e}")
+
+    try:
+        notification_add(
+            username,
+            f"Correct flag for '<a href=\"/crackme/{hexid}\">{html_escape(crackme.get('name', ''))}</a>' - {points} points earned!"
+        )
+    except Exception as e:
+        print(f"Notification error: {e}")
+
+    flash(f'Correct! You earned {points} points.', FLASH_SUCCESS)
+    return redirect(f'/crackme/{hexid}')
 
 
 @crackme_bp.route('/crackme/<hexid>/edit', methods=['GET'])
diff --git a/app/controllers/rating.py b/app/controllers/rating.py
index 2136f79..0b8b942 100644
--- a/app/controllers/rating.py
+++ b/app/controllers/rating.py
@@ -3,12 +3,18 @@
 """
 
 from flask import Blueprint, request, redirect, flash, session
-from app.models.crackme import crackme_update_difficulty, crackme_update_quality
+from app.models.crackme import (
+    crackme_by_hexid, crackme_is_auto_validated,
+    crackme_update_difficulty, crackme_update_quality
+)
+from app.models.errors import ErrNoResult
 from app.models.rating import (
     is_already_rated_difficulty, is_already_rated_quality,
     rating_difficulty_create, rating_difficulty_set_rating,
     rating_quality_create, rating_quality_set_rating
 )
+from app.models.solve import solve_by_user_and_crackme
+from app.models.user import user_by_name
 from app.services.view import FLASH_ERROR, FLASH_SUCCESS, validate_required
 from app.controllers.decorators import login_required
 
@@ -21,6 +27,21 @@ def rate_difficulty(hexid):
     """Rate a crackme's difficulty."""
     username = session.get('name')
 
+    try:
+        crackme = crackme_by_hexid(hexid)
+    except ErrNoResult:
+        return redirect(f'/crackme/{hexid}'), 404
+    except Exception as e:
+        print(f"Rating error: {e}")
+        return redirect(f'/crackme/{hexid}'), 500
+
+    if crackme_is_auto_validated(crackme):
+        flash(
+            'Difficulty ratings are disabled for auto-validated crackmes.',
+            FLASH_ERROR
+        )
+        return redirect(f'/crackme/{hexid}')
+
     # Validate required fields
     is_valid, missing = validate_required(request.form, ['difficulty'])
     if not is_valid:
@@ -61,6 +82,30 @@ def rate_quality(hexid):
     """Rate a crackme's quality."""
     username = session.get('name')
 
+    try:
+        crackme = crackme_by_hexid(hexid)
+    except ErrNoResult:
+        return redirect(f'/crackme/{hexid}'), 404
+    except Exception as e:
+        print(f"Rating error: {e}")
+        return redirect(f'/crackme/{hexid}'), 500
+
+    if crackme_is_auto_validated(crackme):
+        try:
+            user = user_by_name(username)
+            user_hexid = user.get('hexid') or str(user['_id'])
+            has_solved = solve_by_user_and_crackme(user_hexid, hexid)
+        except Exception as e:
+            print(f"Rating error: {e}")
+            return redirect(f'/crackme/{hexid}'), 500
+
+        if not has_solved:
+            flash(
+                'Solve this crackme before rating it.',
+                FLASH_ERROR
+            )
+            return redirect(f'/crackme/{hexid}')
+
     # Validate required fields
     is_valid, missing = validate_required(request.form, ['quality'])
     if not is_valid:
diff --git a/app/controllers/solution.py b/app/controllers/solution.py
index 96ec93f..1c382fe 100644
--- a/app/controllers/solution.py
+++ b/app/controllers/solution.py
@@ -9,10 +9,10 @@
 
 import os
 from html import escape as html_escape
-from flask import Blueprint, render_template, request, redirect, flash, session, abort, current_app, Response
+from flask import Blueprint, render_template, request, redirect, flash, session, abort, current_app, Response, jsonify
 from werkzeug.utils import secure_filename
 import bleach
-from app.models.crackme import crackme_by_hexid
+from app.models.crackme import crackme_by_hexid, crackme_is_auto_validated
 from app.models.solution import solution_create, solution_exists, solution_by_hexid
 from app.models.notification import notification_add
 from app.models.errors import ErrNoResult
@@ -68,12 +68,32 @@ def _send_notifications_and_render_success(username, crackme):
     except Exception as e:
         print(f"Notification error: {e}")
 
+    if _wants_json():
+        session['submitted_writeup'] = crackme['name']
+        return jsonify({
+            'ok': True,
+            'redirect': '/upload/solution/submitted',
+        })
+
     return render_template('submission/success.html',
                            submission_type='Writeup',
                            name=crackme['name'],
                            username=username)
 
 
+def _wants_json():
+    """True when the editor submitted in the background."""
+    return request.headers.get('X-Requested-With') == 'XMLHttpRequest'
+
+
+def _submission_rejected(message, redirect_url):
+    """Reject without navigating away from a background-submitted editor."""
+    if _wants_json():
+        return jsonify({'ok': False, 'error': message}), 400
+    flash(message, FLASH_ERROR)
+    return redirect(redirect_url)
+
+
 def _validate_attachment(file):
     """Validate an uploaded attachment. Returns (data, error_message).
 
@@ -110,6 +130,12 @@ def _validate_attachment(file):
 def upload_solution_get(hexidcrackme):
     """Display the solution submission form (markdown editor + optional attachment)."""
     crackme = _get_crackme_or_abort(hexidcrackme)
+    if crackme_is_auto_validated(crackme):
+        flash(
+            'Writeups are disabled for auto-validated crackmes.',
+            FLASH_ERROR
+        )
+        return redirect(f'/crackme/{hexidcrackme}')
     return render_template('solution/editor.html',
                            hexidcrackme=hexidcrackme,
                            username=crackme.get('author', ''),
@@ -135,30 +161,42 @@ def upload_solution_post(hexidcrackme):
     username = session.get('name')
     redirect_url = f'/upload/solution/{hexidcrackme}'
 
+    if crackme_is_auto_validated(crackme):
+        return _submission_rejected(
+            'Writeups are disabled for auto-validated crackmes.',
+            f'/crackme/{hexidcrackme}',
+        )
+
     # Check if user already submitted a solution
     if solution_exists(username, crackme['_id']):
-        flash("You've already submitted a solution to this crackme", FLASH_ERROR)
-        return redirect(redirect_url)
+        return _submission_rejected(
+            "You've already submitted a solution to this crackme", redirect_url
+        )
 
     if not verify_recaptcha(request):
-        flash('reCAPTCHA invalid!', FLASH_ERROR)
-        return redirect(redirect_url)
+        return _submission_rejected('reCAPTCHA invalid!', redirect_url)
 
     # Summary
     info = bleach.clean(request.form.get('info', ''))
     if len(info) > MAX_INFO_LENGTH:
-        flash(f'Info field exceeds maximum length of {MAX_INFO_LENGTH} characters.', FLASH_ERROR)
-        return redirect(redirect_url)
+        return _submission_rejected(
+            f'Info field exceeds maximum length of {MAX_INFO_LENGTH} characters.',
+            redirect_url,
+        )
 
     # Inline markdown content (optional)
     content = request.form.get('content', '').strip()
     if content:
         if len(content) < MIN_CONTENT_LENGTH:
-            flash(f'Your writeup is too short. Please write at least {MIN_CONTENT_LENGTH} characters.', FLASH_ERROR)
-            return redirect(redirect_url)
+            return _submission_rejected(
+                f'Your writeup is too short. Please write at least {MIN_CONTENT_LENGTH} characters.',
+                redirect_url,
+            )
         if len(content) > MAX_CONTENT_LENGTH:
-            flash(f'Your writeup exceeds the maximum length of {MAX_CONTENT_LENGTH:,} characters.', FLASH_ERROR)
-            return redirect(redirect_url)
+            return _submission_rejected(
+                f'Your writeup exceeds the maximum length of {MAX_CONTENT_LENGTH:,} characters.',
+                redirect_url,
+            )
     else:
         content = None
 
@@ -170,14 +208,15 @@ def upload_solution_post(hexidcrackme):
     if has_file:
         data, error = _validate_attachment(file)
         if error:
-            flash(error, FLASH_ERROR)
-            return redirect(redirect_url)
+            return _submission_rejected(error, redirect_url)
         original_filename = secure_filename(file.filename) or "unnamed"
 
     # A solution must have a writeup body: markdown content, an attachment, or both.
     if content is None and not has_file:
-        flash('Please write a markdown writeup or attach a file (or both).', FLASH_ERROR)
-        return redirect(redirect_url)
+        return _submission_rejected(
+            'Please write a markdown writeup or attach a file (or both).',
+            redirect_url,
+        )
 
     try:
         solution = solution_create(info, username, crackme, content=content, original_filename=original_filename)
@@ -198,12 +237,27 @@ def upload_solution_post(hexidcrackme):
                 get_collection('solution').delete_one({'hexid': solution['hexid']})
             except Exception as cleanup_error:
                 print(f"Failed to roll back solution record: {cleanup_error}")
-            flash('An error occurred on the server. Please try again later.', FLASH_ERROR)
-            return redirect(redirect_url)
+            return _submission_rejected(
+                'An error occurred on the server. Please try again later.',
+                redirect_url,
+            )
 
     return _send_notifications_and_render_success(username, crackme)
 
 
+@solution_bp.route('/upload/solution/submitted', methods=['GET'])
+@login_required
+def upload_solution_submitted():
+    """Confirm a writeup submitted by the background editor."""
+    name = session.pop('submitted_writeup', None)
+    if not name:
+        return redirect('/')
+    return render_template(
+        'submission/success.html', submission_type='Writeup',
+        name=name, username=session.get('name'),
+    )
+
+
 @solution_bp.route('/solution/<hexid>', methods=['GET'])
 def view_solution(hexid):
     """Display a solution's writeup page (public)."""
diff --git a/app/controllers/user.py b/app/controllers/user.py
index 84bb8d7..3c82fd2 100644
--- a/app/controllers/user.py
+++ b/app/controllers/user.py
@@ -4,9 +4,10 @@
 
 from flask import Blueprint, render_template, session, abort
 from app.models.user import user_by_name
-from app.models.crackme import crackmes_by_user
+from app.models.crackme import crackmes_by_user, crackmes_by_hexids
 from app.models.solution import solutions_by_user
 from app.models.comment import comments_by_user
+from app.models.solve import solves_by_user
 from app.models.errors import ErrNoResult
 
 user_bp = Blueprint('user', __name__)
@@ -46,6 +47,22 @@ def user_profile(name):
                 'crackmename': solution.get('crackmename', '')
             })
 
+        # Solved crackmes and the score they add up to. Names are looked up in
+        # one batch rather than stored on the solve, so a renamed or deleted
+        # crackme can't leave a stale title behind on the profile.
+        solves = solves_by_user(user.get('hexid') or str(user['_id']))
+        solved_crackmes = crackmes_by_hexids([s['crackme_hexid'] for s in solves])
+        solves_extended = [
+            {
+                'solve': solve,
+                'crackmehexid': solve['crackme_hexid'],
+                'crackmename': solved_crackmes.get(solve['crackme_hexid'], {})
+                                              .get('name', 'Unknown crackme'),
+            }
+            for solve in solves
+        ]
+        score = sum(solve.get('points', 0) for solve in solves)
+
         # Check if viewing own profile
         session_username = session.get('name', '')
         viewing_own_page = session_username and session_username == actual_username
@@ -55,9 +72,11 @@ def user_profile(name):
                                NbCrackmes=nb_crackmes,
                                NbSolutions=nb_solutions,
                                NbComments=nb_comments,
+                               Score=score,
                                crackmes=crackmes,
                                solutions=solutions_extended,
                                comments=comments,
+                               solves=solves_extended,
                                viewingOwnPage=viewing_own_page)
 
     except Exception as e:
diff --git a/app/models/crackme.py b/app/models/crackme.py
index 3780db0..d72a91a 100644
--- a/app/models/crackme.py
+++ b/app/models/crackme.py
@@ -263,6 +263,31 @@ def crackmes_by_user(username):
                 .sort('created_at', DESCENDING))
 
 
+def crackmes_by_hexids(hexids):
+    """Look up several crackmes at once.
+
+    Args:
+        hexids: An iterable of crackme hex IDs.
+
+    Returns:
+        A dict of hexid -> crackme document, holding only the ids that exist and
+        are visible. Callers listing references to crackmes (a user's solves,
+        say) use this to resolve names in one query instead of one per row.
+    """
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    hexids = list(hexids)
+    if not hexids:
+        return {}
+
+    collection = get_collection('crackme')
+    return {
+        crackme['hexid']: crackme
+        for crackme in collection.find({'hexid': {'$in': hexids}, 'visible': True})
+    }
+
+
 def crackme_by_user_and_name(username, name, visible=True):
     """Get crackme by user and name."""
     if not check_connection():
@@ -281,8 +306,19 @@ def crackme_by_user_and_name(username, name, visible=True):
     return result
 
 
-def crackme_create_prepare(name, info, username, lang, arch, platform, size, original_filename, labels=None):
-    """Prepare a crackme object without inserting it."""
+def crackme_create_prepare(name, info, username, lang, arch, platform, size, original_filename,
+                           labels=None, flag=None, source_original_filename=None,
+                           official_difficulty=None):
+    """Prepare a crackme object without inserting it.
+
+    Args:
+        flag: The author's flag when they opted into auto-validation, else None.
+            Its presence is what marks a crackme as auto-validated -- there is
+            no separate flag to keep in sync. Stored in cleartext for reviewers;
+            never rendered on the public site.
+        source_original_filename: Filename of the private source archive that
+            accompanies an auto-validated submission (reviewers only).
+    """
     if not check_connection():
         raise ErrUnavailable("Database is unavailable")
 
@@ -307,10 +343,20 @@ def crackme_create_prepare(name, info, username, lang, arch, platform, size, ori
         'platform': platform,
         'size': size,
         'original_filename': original_filename,
-        'labels': labels or []
+        'labels': labels or [],
+        'flag': flag,
+        'source_original_filename': source_original_filename,
+        # For auto-validation, the author chooses an integer point value and we
+        # store points / 100 here so the existing scoring field stays canonical.
+        'official_difficulty': official_difficulty,
     }
 
 
+def crackme_is_auto_validated(crackme):
+    """Return True if a crackme accepts flag submissions."""
+    return bool(crackme.get('flag'))
+
+
 def crackme_insert(crackme):
     """Insert a prepared crackme into the database."""
     if not check_connection():
@@ -408,6 +454,44 @@ def crackme_set_labels(hexid, labels):
     return old_labels
 
 
+def crackme_set_official_difficulty(hexid, difficulty):
+    """Store the difficulty level a reviewer assigned to a crackme.
+
+    This is the number solves are priced at (see :mod:`app.services.points`).
+    It is deliberately separate from the ``difficulty`` field, which is the
+    community rating average and keeps moving as people rate the crackme.
+
+    Args:
+        hexid: The hex ID of the crackme
+        difficulty: Difficulty value 1-6, with up to two decimal places
+
+    Returns:
+        True if the crackme was updated, False if it was not found or the
+        difficulty was out of range.
+    """
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    try:
+        difficulty = float(difficulty)
+    except (TypeError, ValueError):
+        return False
+
+    if difficulty < 1 or difficulty > 6:
+        return False
+
+    # Point values are whole numbers, so stored difficulty has at most two
+    # decimal places (points / 100).
+    if abs(round(difficulty * 100) - difficulty * 100) > 1e-9:
+        return False
+
+    result = get_collection('crackme').update_one(
+        {'hexid': hexid},
+        {'$set': {'official_difficulty': difficulty}}
+    )
+    return result.matched_count == 1
+
+
 def crackme_by_hexid_any(hexid):
     """Get crackme by hex ID regardless of visibility status.
 
diff --git a/app/models/flag_submission.py b/app/models/flag_submission.py
new file mode 100644
index 0000000..a70eb59
--- /dev/null
+++ b/app/models/flag_submission.py
@@ -0,0 +1,52 @@
+"""Persistent audit records for user flag-submission attempts."""
+
+from datetime import datetime, timezone
+
+from bson import ObjectId
+
+from app.models.errors import ErrUnavailable
+from app.services.database import get_collection, check_connection
+
+
+def flag_submission_create(
+        user_hexid, username, crackme_hexid, submitted_flag, result):
+    """Persist one flag-validation attempt and return the inserted document."""
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    obj_id = ObjectId()
+    submission = {
+        '_id': obj_id,
+        'hexid': str(obj_id),
+        'user_hexid': user_hexid,
+        'username': username,
+        'crackme_hexid': crackme_hexid,
+        'submitted_flag': submitted_flag,
+        'result': result,
+        'created_at': datetime.now(timezone.utc),
+    }
+    get_collection('flag_submission').insert_one(submission)
+    return submission
+
+
+def flag_submissions_by_crackme(crackme_hexid, limit=100):
+    """Return the newest audit entries for a crackme."""
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    return list(
+        get_collection('flag_submission')
+        .find({'crackme_hexid': crackme_hexid})
+        .sort('created_at', -1)
+        .limit(limit)
+    )
+
+
+def count_flag_submissions_by_crackme(crackme_hexid):
+    """Return the number of attempted flag submissions for a crackme."""
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    return get_collection('flag_submission').count_documents({
+        'crackme_hexid': crackme_hexid,
+    })
diff --git a/app/models/solve.py b/app/models/solve.py
new file mode 100644
index 0000000..51f7773
--- /dev/null
+++ b/app/models/solve.py
@@ -0,0 +1,115 @@
+"""Solve model - records of users who submitted a crackme's correct flag.
+
+A solve is the unit the point system is built on: one record per (user,
+crackme) pair, carrying the points awarded at the moment it was earned.
+
+Solves are keyed by the user's immutable hexid rather than their username.
+Usernames are display data that can change; a score that silently zeroed out
+when someone renamed themselves would be worse than no score at all.
+"""
+
+from datetime import datetime, timezone
+
+from bson import ObjectId
+
+from app.models.errors import ErrUnavailable
+from app.services.database import get_collection, check_connection
+
+
+def solve_by_user_and_crackme(user_hexid, crackme_hexid):
+    """Return the user's solve of a crackme, or None if they haven't solved it."""
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    return get_collection('solve').find_one({
+        'user_hexid': user_hexid,
+        'crackme_hexid': crackme_hexid,
+    })
+
+
+def solve_create(user_hexid, crackme_hexid, points, difficulty):
+    """Record a solve and return it.
+
+    Args:
+        user_hexid: The solver's immutable hexid.
+        crackme_hexid: The solved crackme's hexid.
+        points: Points awarded, snapshotted so a later change to the scoring
+            formula doesn't retroactively re-price solves already earned.
+        difficulty: The difficulty level those points were priced at.
+
+    Returns:
+        The inserted solve document, or the existing one if the user had
+        already solved this crackme (double-submits are a no-op, never a
+        second award).
+    """
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    collection = get_collection('solve')
+    existing = collection.find_one({
+        'user_hexid': user_hexid,
+        'crackme_hexid': crackme_hexid,
+    })
+    if existing:
+        return existing
+
+    obj_id = ObjectId()
+    solve = {
+        '_id': obj_id,
+        'hexid': str(obj_id),
+        'user_hexid': user_hexid,
+        'crackme_hexid': crackme_hexid,
+        'created_at': datetime.now(timezone.utc),
+        'points': int(points),
+        'difficulty': float(difficulty),
+    }
+    collection.insert_one(solve)
+    return solve
+
+
+def solves_by_user(user_hexid):
+    """Get a user's solves, newest first."""
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    solves = list(get_collection('solve').find({'user_hexid': user_hexid}))
+    solves.sort(key=lambda s: s.get('created_at') or s['_id'].generation_time,
+                reverse=True)
+    return solves
+
+
+def user_score(user_hexid):
+    """Return a user's total score: the sum of the points on their solves.
+
+    Summed from the solve records rather than kept as a counter on the user
+    document, so the score can never drift out of step with the solves it is
+    supposed to represent (a deleted crackme takes its points with it).
+    """
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    solves = get_collection('solve').find({'user_hexid': user_hexid},
+                                          {'points': 1})
+    return sum(solve.get('points', 0) for solve in solves)
+
+
+def count_solves_by_crackme(crackme_hexid):
+    """Count how many users have solved a crackme."""
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    return get_collection('solve').count_documents(
+        {'crackme_hexid': crackme_hexid}
+    )
+
+
+def solves_by_crackme(crackme_hexid):
+    """Return a crackme's solves, oldest first."""
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    return list(
+        get_collection('solve')
+        .find({'crackme_hexid': crackme_hexid})
+        .sort('created_at', 1)
+    )
diff --git a/app/models/user.py b/app/models/user.py
index e84350f..c502e80 100644
--- a/app/models/user.py
+++ b/app/models/user.py
@@ -109,6 +109,27 @@ def all_users_visible():
     return list(collection.find({'visible': True}))
 
 
+def users_by_hexids(hexids):
+    """Return visible users keyed by immutable hexid."""
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    hexids = list(hexids)
+    if not hexids:
+        return {}
+    return {
+        user.get('hexid') or str(user['_id']): user
+        for user in get_collection('user').find({
+            '$or': [
+                {'hexid': {'$in': hexids}},
+                {'_id': {'$in': [ObjectId(value) for value in hexids
+                                  if ObjectId.is_valid(value)]}},
+            ],
+            'visible': True,
+        })
+    }
+
+
 def user_create(name, email, password):
     """Create a new user.
 
diff --git a/app/services/archive.py b/app/services/archive.py
index 8caadee..ad7d784 100644
--- a/app/services/archive.py
+++ b/app/services/archive.py
@@ -169,6 +169,11 @@ def is_single_file_archive(file_data: bytes) -> bool:
     return file_count == 1
 
 
+def is_zip_archive(file_data: bytes) -> bool:
+    """Return whether ``file_data`` is a readable ZIP archive."""
+    return get_archive_file_count(file_data) is not None
+
+
 def is_archive_password_protected(file_data: bytes) -> bool:
     """Check if an archive file is password-protected.
 
diff --git a/app/services/discord.py b/app/services/discord.py
index acb4ead..f6cd15f 100644
--- a/app/services/discord.py
+++ b/app/services/discord.py
@@ -192,6 +192,79 @@ def notify_new_solution(username: str, crackme_name: str) -> bool:
     return send_private_notification(embed=embed)
 
 
+def notify_flag_solved(username: str, crackme_name: str,
+                       crackme_hexid: str, points: int) -> bool:
+    """Announce a successful auto-validated solve in the public channel."""
+    timestamp = (
+        datetime.datetime.utcnow()
+        .replace(tzinfo=timezone.utc)
+        .isoformat(timespec='milliseconds')
+        .replace('+00:00', 'Z')
+    )
+    base_url = get_base_url()
+    embed = {
+        "title": "Crackme Solved",
+        "description": "A player submitted the correct flag",
+        "color": 65280,
+        "fields": [
+            {
+                "name": "Challenge",
+                "value": f"[{crackme_name}]({base_url}/crackme/{crackme_hexid})",
+                "inline": True,
+            },
+            {
+                "name": "Player",
+                "value": f"[{username}]({base_url}/user/{username})",
+                "inline": True,
+            },
+            {"name": "Points", "value": str(points), "inline": True},
+        ],
+        "footer": {"text": "CrackMes.One"},
+        "timestamp": timestamp,
+    }
+    if not is_enabled():
+        return True
+    return send_to_webhook(get_public_webhook(), embed=embed)
+
+
+def notify_flag_submission(username: str, crackme_name: str,
+                           crackme_hexid: str, submitted_flag: str,
+                           result: str) -> bool:
+    """Send every flag attempt, including its value, to the audit channel."""
+    timestamp = (
+        datetime.datetime.utcnow()
+        .replace(tzinfo=timezone.utc)
+        .isoformat(timespec='milliseconds')
+        .replace('+00:00', 'Z')
+    )
+    base_url = get_base_url()
+    # Discord limits an embed field to 1,024 characters. The database remains
+    # the canonical, untruncated audit record.
+    displayed_flag = submitted_flag[:1021] + "..." if len(submitted_flag) > 1024 else submitted_flag
+    embed = {
+        "title": "Flag Submitted",
+        "description": "Auto-validation attempt recorded",
+        "color": 65280 if result == 'correct' else 16744448,
+        "fields": [
+            {
+                "name": "Challenge",
+                "value": f"[{crackme_name}]({base_url}/crackme/{crackme_hexid})",
+                "inline": True,
+            },
+            {
+                "name": "User",
+                "value": f"[{username}]({base_url}/user/{username})",
+                "inline": True,
+            },
+            {"name": "Result", "value": result, "inline": True},
+            {"name": "Submitted flag", "value": displayed_flag or "(empty)", "inline": False},
+        ],
+        "footer": {"text": "CrackMes.One Internal Audit"},
+        "timestamp": timestamp,
+    }
+    return send_private_notification(embed=embed)
+
+
 def send_moderation_notification(embed: dict) -> bool:
     """Send a notification to the moderation Discord channel.
 
diff --git a/app/services/flag.py b/app/services/flag.py
new file mode 100644
index 0000000..7d9e60d
--- /dev/null
+++ b/app/services/flag.py
@@ -0,0 +1,55 @@
+"""Flag format and comparison for auto-validated crackmes.
+
+Authors of an auto-validated crackme give us the correct flag once, at upload
+time. It is stored in cleartext so reviewers can read it: verifying that a
+submission really is solvable, and fixing a mistyped flag afterwards, both need
+the actual value, and a hash would leave a wrong flag undetectable until users
+started failing on it.
+
+Cleartext storage means the flag must never leave the reviewer tool: the public
+crackme page renders a fixed set of fields and the flag is not among them (see
+``crackme_view``), and submissions are only ever compared against it here.
+"""
+
+import hmac
+import re
+
+# Standardised flag format, per issue #127: a CMO prefix and a brace-delimited
+# body, so a flag is always a single unambiguous token that authors can embed in
+# a binary and users can copy-paste.
+FLAG_PREFIX = 'CMO'
+FLAG_BODY_MAX = 56
+# Printable ASCII (0x21-0x7e) minus the braces, which keeps the closing brace
+# unambiguous. Keeping a flag a single whitespace-free ASCII token means neither
+# copy-pasting it out of a terminal nor re-encoding it can silently change it.
+FLAG_PATTERN = re.compile(
+    r'^%s\{[\x21-\x7a\x7c\x7e]{1,%d}\}$' % (FLAG_PREFIX, FLAG_BODY_MAX)
+)
+
+FLAG_FORMAT_HINT = f'Flags look like {FLAG_PREFIX}{{...}}'
+
+
+def normalize_flag(flag):
+    """Return a submitted flag with surrounding whitespace removed.
+
+    Users copy flags out of terminals, so leading/trailing whitespace is noise
+    rather than a wrong answer. Inner characters are left untouched -- they are
+    part of the flag.
+    """
+    return (flag or '').strip()
+
+
+def is_valid_flag_format(flag):
+    """Return True if the flag matches the standardised CMO{...} format."""
+    return bool(FLAG_PATTERN.match(flag or ''))
+
+
+def flags_match(stored_flag, submitted_flag):
+    """Return True if a submitted flag matches the crackme's stored one.
+
+    Compared in constant time so the response can't be used to recover the flag
+    character by character.
+    """
+    if not stored_flag or not submitted_flag:
+        return False
+    return hmac.compare_digest(stored_flag, submitted_flag)
diff --git a/app/services/limiter.py b/app/services/limiter.py
index 2f2a340..d7b536a 100644
--- a/app/services/limiter.py
+++ b/app/services/limiter.py
@@ -15,6 +15,7 @@
 | POST /upload/crackme    | 10 per day     | Username    | Prevent submission spam          |
 | POST /upload/solution   | 20 per day     | Username    | Prevent submission spam          |
 | POST /comment           | 30 per hour    | Username    | Prevent comment spam             |
+| POST /crackme/../solve  | 5/min, 20/hr   | Username    | Prevent flag brute-forcing       |
 +-------------------------+----------------+-------------+----------------------------------+
 
 Configuration
@@ -40,6 +41,10 @@
 limiter = None
 limiter_config = {}
 
+DEFAULT_LIMITS = {
+    'FlagSubmissions': '5 per minute; 20 per hour',
+}
+
 
 def init_limiter(app, config):
     """Initialize rate limiter with configuration.
@@ -51,7 +56,13 @@ def init_limiter(app, config):
             - StorageUri: str - Storage backend URI (default: memory://)
     """
     global limiter, limiter_config
-    limiter_config = config
+    # Abuse protection is on by default. Deployments and tests can explicitly
+    # disable it, select another storage backend, or override named limits.
+    limiter_config = {
+        'Enabled': True,
+        'StorageUri': 'memory://',
+        **(config or {}),
+    }
 
     if not is_enabled():
         # Create a no-op limiter that doesn't actually limit
@@ -83,6 +94,11 @@ def get_limiter():
     return limiter
 
 
+def configured_limit(name):
+    """Return a named route limit, falling back to its built-in default."""
+    return limiter_config.get('Limits', {}).get(name, DEFAULT_LIMITS[name])
+
+
 def limit(*args, **kwargs):
     """Decorator for rate limiting routes.
 
diff --git a/app/services/points.py b/app/services/points.py
new file mode 100644
index 0000000..668fa37
--- /dev/null
+++ b/app/services/points.py
@@ -0,0 +1,43 @@
+"""Scoring rules for solved crackmes.
+
+PROVISIONAL: the point system is still being designed (issue #127 lists first
+blood on old crackmes, writeup points, author-funded bounties and decay-by-solve-
+count as candidates). Only the base "solve an auto-validated crackme" award is
+implemented so far, and the numbers here are expected to change.
+
+Everything about the formula lives in this module so a later change is one edit.
+Awards are snapshotted onto the solve record at solve time (see
+:mod:`app.models.solve`), so tuning the formula re-prices future solves without
+silently rewriting everyone's score history.
+"""
+
+# Points per difficulty level: a level 3 crackme is worth 300.
+POINTS_PER_DIFFICULTY = 100
+
+MIN_DIFFICULTY = 1
+MAX_DIFFICULTY = 6
+
+
+def solve_difficulty(crackme):
+    """Return the difficulty level a solve of ``crackme`` is priced at.
+
+    Prefers the ``official_difficulty`` a reviewer assigned when approving the
+    crackme -- issue #127 wants that number fixed, immune to the community
+    difficulty rating drifting after the fact. Crackmes approved before the
+    reviewer form existed have no official difficulty, so those fall back to the
+    community rating, rounded and clamped into the 1-6 scale.
+    """
+    official = crackme.get('official_difficulty')
+    if official:
+        return _clamp(float(official))
+
+    return _clamp(round(crackme.get('difficulty') or 0))
+
+
+def points_for_solve(crackme):
+    """Return the points awarded for solving ``crackme``."""
+    return round(solve_difficulty(crackme) * POINTS_PER_DIFFICULTY)
+
+
+def _clamp(difficulty):
+    return max(MIN_DIFFICULTY, min(MAX_DIFFICULTY, difficulty))
diff --git a/config/config.json.example b/config/config.json.example
index 85fa7bb..dd3c487 100644
--- a/config/config.json.example
+++ b/config/config.json.example
@@ -18,7 +18,10 @@
     },
     "RateLimiter": {
         "Enabled": true,
-        "StorageUri": "memory://"
+        "StorageUri": "memory://",
+        "Limits": {
+            "FlagSubmissions": "5 per minute; 20 per hour"
+        }
     },
     "Discord": {
         "Enabled": false,
diff --git a/review/routes.py b/review/routes.py
index eab0686..c0784b5 100644
--- a/review/routes.py
+++ b/review/routes.py
@@ -27,6 +27,7 @@
 import requests
 from rustyzipper import compress_file, EncryptionMethod
 from bson.objectid import ObjectId
+from werkzeug.utils import secure_filename
 
 from review.logger import log_reviewer_operation
 from review.auth import (
@@ -45,6 +46,15 @@
 from app.services.crypto import get_obfuscation_salt
 from app.services.view import is_valid_hexid
 from app.services.labels import get_label_groups, normalize_labels
+from app.services.crackme_fields import (
+    ARCH_CHOICES, LANG_CHOICES, PLATFORM_CHOICES,
+)
+from app.services.flag import (
+    FLAG_FORMAT_HINT, is_valid_flag_format, normalize_flag
+)
+from app.services.archive import (
+    is_archive_password_protected, is_unsupported_archive
+)
 from app.models.label_request import (
     label_requests_pending, count_pending_label_requests, label_request_by_hexid,
     label_request_set_status, STATUS_APPROVED, STATUS_REJECTED,
@@ -171,6 +181,27 @@ def get_static_dir(item_type):
     return os.path.join(CRACKMESONE_DIR, 'static', item_type)
 
 
+def get_source_dir():
+    """
+    Get the directory holding private source archives.
+
+    Auto-validated crackmes ship with a source archive that only reviewers may
+    read, so it lives outside static/ and is never linked from the public site.
+
+    Returns:
+        Absolute path to the private source archive directory
+    """
+    return os.path.join(CRACKMESONE_DIR, 'private', 'crackme_source')
+
+
+def delete_source_archive(hexid):
+    """Remove a crackme's private source archive, if it has one."""
+    try:
+        os.remove(os.path.join(get_source_dir(), hexid))
+    except OSError:
+        pass
+
+
 def find_pending_file(item_type, hexid):
     """
     Find a pending submission file by its hexid.
@@ -605,7 +636,14 @@ def get_crackme_details(uuid):
         "lang": crackme_obj["lang"],
         "arch": crackme_obj["arch"],
         "platform": crackme_obj["platform"],
-        "labels": crackme_obj.get("labels", [])
+        "labels": crackme_obj.get("labels", []),
+        # Auto-validation. The flag is reviewer-only data: it reaches this
+        # template and nowhere else.
+        "flag": crackme_obj.get("flag"),
+        "auto_validation": bool(crackme_obj.get("flag")),
+        "has_source_archive": bool(crackme_obj.get("source_original_filename")),
+        "difficulty": crackme_obj.get("difficulty", 0),
+        "official_difficulty": crackme_obj.get("official_difficulty")
     }, None
 
 
@@ -641,6 +679,10 @@ def reject_pending_crackme(hexid, reject_reason=None):
         if os.path.exists(file_path):
             os.remove(file_path)
 
+        # A rejected submission's private source archive has no reason to stay
+        # on disk.
+        delete_source_archive(hexid)
+
         # Notify author
         notif_text = f"Your crackme '{html_escape(crackme['name'])}' has been rejected!"
         if reject_reason:
@@ -933,6 +975,8 @@ def delete_approved_crackme(crackme_uuid):
     except Exception:
         pass
 
+    delete_source_archive(crackme_uuid)
+
     # Delete crackme document
     g_crackmesone_db.crackme.delete_one({"_id": ObjectId(crackme_uuid)})
 
@@ -940,7 +984,8 @@ def delete_approved_crackme(crackme_uuid):
         f"Cascade deleted: {deleted['solutions']} solutions, "
         f"{deleted['comments']} comments, "
         f"{deleted['difficulty_ratings']} difficulty ratings, "
-        f"{deleted['quality_ratings']} quality ratings\n"
+        f"{deleted['quality_ratings']} quality ratings, "
+        f"{deleted['solves']} solves\n"
         "Crackme deleted"
     )
 
@@ -960,7 +1005,9 @@ def _cascade_delete_crackme_data(crackme_id, crackme_hexid):
         'solutions': 0,
         'comments': 0,
         'difficulty_ratings': 0,
-        'quality_ratings': 0
+        'quality_ratings': 0,
+        'solves': 0,
+        'flag_submissions': 0
     }
 
     # Delete solutions
@@ -988,6 +1035,18 @@ def _cascade_delete_crackme_data(crackme_id, crackme_hexid):
     })
     deleted['quality_ratings'] = result.deleted_count
 
+    # Solve records, and with them the points their solvers earned: the crackme
+    # they were awarded for no longer exists to back them up.
+    result = g_crackmesone_db.solve.delete_many({
+        'crackme_hexid': crackme_hexid
+    })
+    deleted['solves'] = result.deleted_count
+
+    result = g_crackmesone_db.flag_submission.delete_many({
+        'crackme_hexid': crackme_hexid
+    })
+    deleted['flag_submissions'] = result.deleted_count
+
     return deleted
 
 
@@ -1057,6 +1116,8 @@ def preview_user_deletion(user_email):
         'email': user_email,
         'notifications': 0,
         'solutions': 0,
+        'solves': 0,
+        'flag_submissions': 0,
         'crackmes': 0,
         'crackme_details': [],
         'user_comments': 0,
@@ -1075,6 +1136,12 @@ def preview_user_deletion(user_email):
         preview['solutions'] = db.solution.count_documents({
             "author": username
         })
+        preview['solves'] = db.solve.count_documents({
+            "user_hexid": user.get("hexid") or str(user["_id"])
+        })
+        preview['flag_submissions'] = db.flag_submission.count_documents({
+            "user_hexid": user.get("hexid") or str(user["_id"])
+        })
 
         # Count data for each crackme
         for crackme in db.crackme.find({"author": username}):
@@ -1087,6 +1154,7 @@ def preview_user_deletion(user_email):
                     'hexid': hexid,
                     'solutions': db.solution.count_documents({"crackmeid": cid}),
                     'comments': db.comment.count_documents({"crackmehexid": hexid}),
+                    'solves': db.solve.count_documents({"crackme_hexid": hexid}),
                     'difficulty_ratings': db.rating_difficulty.count_documents({
                         "crackmehexid": hexid
                     }),
@@ -1164,7 +1232,20 @@ def delete_user_account(user_email, admin_username=None):
         result = db.notifications.delete_many({"user": username})
         deletion_log.append(f"Deleted {result.deleted_count} notifications")
 
-        # 2. Delete user's solutions
+        # 2. Delete the user's solve records (their score goes with the account)
+        result = db.solve.delete_many({
+            "user_hexid": user.get("hexid") or str(user["_id"])
+        })
+        deletion_log.append(f"Deleted {result.deleted_count} solves by user")
+
+        result = db.flag_submission.delete_many({
+            "user_hexid": user.get("hexid") or str(user["_id"])
+        })
+        deletion_log.append(
+            f"Deleted {result.deleted_count} flag submissions by user"
+        )
+
+        # 2b. Delete user's solutions
         solution_count = 0
         for solution in db.solution.find({"author": username}):
             delete_approved_solution(str(solution["_id"]))
@@ -1399,6 +1480,40 @@ def dashboard(current_user):
     )
 
 
+@reviewer_bp.route('/flagvalidations')
+@admin_required
+def flagvalidations(current_user):
+    """Show recent flag submissions and validation results to admins."""
+    submissions = list(
+        g_crackmesone_db.flag_submission
+        .find({})
+        .sort('created_at', -1)
+        .limit(250)
+    )
+    crackme_ids = {
+        item.get('crackme_hexid') for item in submissions
+        if item.get('crackme_hexid')
+    }
+    crackme_names = {
+        item['hexid']: item.get('name', 'Unnamed crackme')
+        for item in g_crackmesone_db.crackme.find(
+            {'hexid': {'$in': list(crackme_ids)}},
+            {'hexid': 1, 'name': 1}
+        )
+    }
+    for item in submissions:
+        item['crackme_name'] = crackme_names.get(
+            item.get('crackme_hexid'), 'Deleted crackme'
+        )
+
+    return render_template(
+        'reviewer/flagvalidations.html',
+        user=current_user['username'],
+        is_admin=True,
+        submissions=submissions,
+    )
+
+
 # =============================================================================
 # Route Handlers - Review Pending Submissions
 # =============================================================================
@@ -1470,40 +1585,46 @@ def viewcrackme(current_user):
         user=current_user['username'],
         is_admin=current_user['is_admin'],
         crackme=crackme,
-        label_groups=get_label_groups()
+        label_groups=get_label_groups(),
+        message=request.args.get('message')
     )
 
 
 @reviewer_bp.route('/downloadreview')
 @token_required
 def downloadreview(current_user):
-    """Download a pending submission file for review."""
+    """Download a pending submission file, or a crackme's private source, for review."""
     download_type = request.args.get("type")
     uuid = request.args.get("uuid")
 
-    if download_type not in ('solution', 'crackme'):
+    if download_type not in ('solution', 'crackme', 'source'):
         abort(404)
 
     if not is_valid_hexid(uuid):
         abort(404)
 
     uuid = uuid.lower()
-    tmp_dir = get_tmp_dir(download_type)
-    file_path = os.path.join(tmp_dir, uuid)
+    if download_type == 'source':
+        # Source archives stay reviewer-only for the crackme's whole life, so
+        # they live in their own private directory rather than tmp/.
+        file_path = os.path.join(get_source_dir(), uuid)
+    else:
+        file_path = os.path.join(get_tmp_dir(download_type), uuid)
 
     if not os.path.exists(file_path):
         abort(404)
 
     # Get original filename from database
-    if download_type == 'crackme':
-        doc = g_crackmesone_db.crackme.find_one({'hexid': uuid})
-    else:
+    if download_type == 'solution':
         doc = g_crackmesone_db.solution.find_one({'hexid': uuid})
+    else:
+        doc = g_crackmesone_db.crackme.find_one({'hexid': uuid})
 
     if not doc:
         print(f"Warning: Orphaned {download_type} file {uuid} exists on disk but not in database")
 
-    original_filename = (doc.get('original_filename') if doc else None) or uuid
+    filename_field = 'source_original_filename' if download_type == 'source' else 'original_filename'
+    original_filename = (doc.get(filename_field) if doc else None) or uuid
 
     return send_file(
         file_path,
@@ -1657,6 +1778,81 @@ def approvecrackme(current_user):
             message="Crackme file not found"
         ))
 
+    crackme_obj = g_crackmesone_db.crackme.find_one({
+        'hexid': crackme_uuid.lower(), 'visible': False,
+    })
+    if not crackme_obj:
+        return redirect(url_for(
+            'reviewer.reviewcrackme', message="Pending crackme not found"
+        ))
+
+    info = request.form.get('info', crackme_obj.get('info', '')).strip()
+    lang = request.form.get('lang', crackme_obj.get('lang', ''))
+    arch = request.form.get('arch', crackme_obj.get('arch', ''))
+    platform = request.form.get('platform', crackme_obj.get('platform', ''))
+    if not info:
+        return redirect(url_for(
+            'reviewer.viewcrackme', crackme_uuid=crackme_uuid,
+            message="Description is required"
+        ))
+    valid_classification = (
+        (lang in LANG_CHOICES or lang == crackme_obj.get('lang')) and
+        (arch in ARCH_CHOICES or arch == crackme_obj.get('arch')) and
+        (platform in PLATFORM_CHOICES or platform == crackme_obj.get('platform'))
+    )
+    if not valid_classification:
+        return redirect(url_for(
+            'reviewer.viewcrackme', crackme_uuid=crackme_uuid,
+            message="Invalid language, architecture, or platform"
+        ))
+
+    updates = {
+        'info': info,
+        'lang': lang,
+        'arch': arch,
+        'platform': platform,
+        'labels': (
+            normalize_labels(request.form.getlist('labels'))
+            if request.form.get('labels_submitted') == '1'
+            else crackme_obj.get('labels', [])
+        ),
+    }
+
+    if crackme_obj.get('flag'):
+        flag = normalize_flag(request.form.get('flag', crackme_obj.get('flag', '')))
+        if not is_valid_flag_format(flag):
+            return redirect(url_for(
+                'reviewer.viewcrackme', crackme_uuid=crackme_uuid,
+                message=f"Invalid flag format. {FLAG_FORMAT_HINT}"
+            ))
+        updates['flag'] = flag
+
+    # Reviewers may adjust the author's proposed reward before approval. The
+    # database keeps this as points / 100 in the official difficulty field.
+    official_points = request.form.get('official_points', '').strip()
+    if (crackme_obj.get('flag') and 'official_points' not in request.form
+            and crackme_obj.get('official_difficulty')):
+        official_points = str(round(crackme_obj['official_difficulty'] * 100))
+    if crackme_obj.get('flag') or official_points:
+        try:
+            official_points = int(official_points)
+        except ValueError:
+            official_points = 0
+        if not 100 <= official_points <= 600:
+            return redirect(url_for(
+                'reviewer.viewcrackme', crackme_uuid=crackme_uuid,
+                message="Points must be a whole number from 100 to 600"
+            ))
+        updates['official_difficulty'] = official_points / 100
+
+    g_crackmesone_db.crackme.update_one(
+        {'_id': crackme_obj['_id']}, {'$set': updates}
+    )
+    log_reviewer_operation(
+        "update_pending_crackme", current_user['username'],
+        {"crackme_uuid": crackme_uuid, "fields": sorted(updates)}, True
+    )
+
     success, message = approve_pending_crackme(crackme_file)
 
     log_reviewer_operation(
@@ -2058,9 +2254,13 @@ def deletecrackme(current_user):
 @reviewer_bp.route('/editcrackme', methods=['GET', 'POST'])
 @admin_required
 def editcrackme(current_user):
-    """Edit an approved crackme (admin only).
+    """Edit every field of a crackme, approved or still pending (admin only).
 
-    Allows editing crackme metadata and optionally replacing the file.
+    This is the one place a crackme can be corrected after the fact: metadata,
+    labels, the binary, and everything auto-validation depends on -- the flag,
+    the private source archive and the official difficulty that fixes what a
+    solve is worth. Difficulty in particular used to be settable only while
+    approving, which left a typo unfixable once the crackme was live.
     """
     message = None
     error = None
@@ -2068,118 +2268,14 @@ def editcrackme(current_user):
 
     crackme_uuid = request.args.get('crackme_uuid') or request.form.get('crackme_uuid')
 
-    if request.method == 'POST' and crackme_uuid:
+    if request.method == 'POST' and crackme_uuid and ObjectId.is_valid(crackme_uuid):
         validate_csrf_token()
+        crackme_obj = g_crackmesone_db.crackme.find_one({"_id": ObjectId(crackme_uuid)})
 
-        # Get form data (name is not editable)
-        info = request.form.get('info', '').strip()
-        lang = request.form.get('lang', '')
-        arch = request.form.get('arch', '')
-        platform = request.form.get('platform', '')
-        labels = normalize_labels(request.form.getlist('labels'))
-        notify_author = request.form.get('notify_author') == 'on'
-
-        if True:
-            # Get current crackme
-            crackme_obj = g_crackmesone_db.crackme.find_one({
-                "_id": ObjectId(crackme_uuid)
-            })
-
-            if not crackme_obj:
-                error = "Crackme not found"
-            else:
-                # Track changes (name is not editable)
-                changes = []
-                if crackme_obj.get('info') != info:
-                    changes.append("description updated")
-                if crackme_obj.get('lang') != lang:
-                    changes.append(f"language: '{crackme_obj.get('lang')}' -> '{lang}'")
-                if crackme_obj.get('arch') != arch:
-                    changes.append(f"arch: '{crackme_obj.get('arch')}' -> '{arch}'")
-                if crackme_obj.get('platform') != platform:
-                    changes.append(f"platform: '{crackme_obj.get('platform')}' -> '{platform}'")
-                if sorted(crackme_obj.get('labels', [])) != sorted(labels):
-                    changes.append(f"labels: {crackme_obj.get('labels', [])} -> {labels}")
-
-                # Update the crackme (name excluded)
-                g_crackmesone_db.crackme.update_one(
-                    {"_id": ObjectId(crackme_uuid)},
-                    {"$set": {
-                        "info": info,
-                        "lang": lang,
-                        "arch": arch,
-                        "platform": platform,
-                        "labels": labels
-                    }}
-                )
-
-                # Handle file replacement
-                file_replaced = False
-                if 'file' in request.files:
-                    file = request.files['file']
-                    if file.filename:
-                        file_data = file.read()
-                        if len(file_data) > 0:
-                            # Save to temp location
-                            temp_path = os.path.join(
-                                CRACKMESONE_DIR, 'tmp',
-                                f"replace_{crackme_uuid}_{file.filename}"
-                            )
-                            os.makedirs(os.path.dirname(temp_path), exist_ok=True)
-
-                            with open(temp_path, 'wb') as f:
-                                f.write(file_data)
-
-                            # Create password-protected zip
-                            dest_path = os.path.join(
-                                get_static_dir('crackme'),
-                                crackme_obj['hexid']
-                            )
-
-                            # Remove old zip first
-                            old_zip = dest_path + ".zip"
-                            if os.path.exists(old_zip):
-                                os.remove(old_zip)
-
-                            success, zip_error = create_password_protected_zip(
-                                temp_path, dest_path, file.filename
-                            )
-
-                            if success:
-                                file_replaced = True
-                                changes.append("file replaced")
-                            else:
-                                error = f"Failed to replace file: {zip_error}"
-
-                if changes:
-                    # Log the operation
-                    log_reviewer_operation(
-                        "edit_crackme_admin", current_user['username'],
-                        {
-                            "crackme_uuid": crackme_uuid,
-                            "crackme_name": crackme_obj.get('name'),
-                            "changes": changes
-                        },
-                        True
-                    )
-
-                    # Notify author if requested
-                    if notify_author and not error:
-                        try:
-                            change_summary = ", ".join(changes[:3])
-                            if len(changes) > 3:
-                                change_summary += f" and {len(changes) - 3} more"
-                            send_user_notification(
-                                crackme_obj['author'],
-                                f"Your crackme '<a href=\"/crackme/{crackme_obj.get('hexid')}\">{html_escape(crackme_obj.get('name'))}</a>' has been updated by an admin: {html_escape(change_summary)}"
-                            )
-                        except Exception as e:
-                            print(f"Notification error: {e}")
-
-                    if not error:
-                        message = f"Crackme '{crackme_obj.get('name')}' updated successfully"
-                else:
-                    message = "No changes were made"
+        if not crackme_obj:
+            error = "Crackme not found"
+        else:
+            error, message = _apply_crackme_edit(current_user, crackme_obj, request)
 
     # Load crackme for display
     if crackme_uuid and ObjectId.is_valid(crackme_uuid):
@@ -2195,9 +2291,15 @@ def editcrackme(current_user):
                 "arch": crackme_obj.get('arch', ''),
                 "platform": crackme_obj.get('platform', ''),
                 "author": crackme_obj.get('author', ''),
-                "labels": crackme_obj.get('labels', [])
+                "labels": crackme_obj.get('labels', []),
+                "visible": crackme_obj.get('visible', False),
+                "difficulty": crackme_obj.get('difficulty', 0),
+                "official_difficulty": crackme_obj.get('official_difficulty'),
+                # Reviewer-only fields; no public view renders either of these.
+                "flag": crackme_obj.get('flag') or '',
+                "source_original_filename": crackme_obj.get('source_original_filename') or ''
             }
-        else:
+        elif not error:
             error = "Crackme not found"
 
     return render_template(
@@ -2207,10 +2309,186 @@ def editcrackme(current_user):
         crackme=crackme,
         message=message,
         error=error,
+        flag_format_hint=FLAG_FORMAT_HINT,
         label_groups=get_label_groups()
     )
 
 
+def _apply_crackme_edit(current_user, crackme_obj, request):
+    """Apply a submitted crackme edit.
+
+    Returns:
+        Tuple of (error, message), either of which may be None.
+    """
+    crackme_uuid = crackme_obj['hexid']
+
+    # Metadata (the crackme's name is not edited here)
+    updates = {
+        'info': request.form.get('info', '').strip(),
+        'lang': request.form.get('lang', ''),
+        'arch': request.form.get('arch', ''),
+        'platform': request.form.get('platform', ''),
+        'labels': normalize_labels(request.form.getlist('labels')),
+    }
+    notify_author = request.form.get('notify_author') == 'on'
+
+    # Official points are stored as points / 100 in official_difficulty. An
+    # empty value clears the override and falls back to the community rating.
+    official_points = request.form.get('official_points', '').strip()
+    if official_points:
+        try:
+            official_points = int(official_points)
+        except ValueError:
+            return "Points must be a whole number from 100 to 600", None
+        if not 100 <= official_points <= 600:
+            return "Points must be a whole number from 100 to 600", None
+        updates['official_difficulty'] = official_points / 100
+    else:
+        updates['official_difficulty'] = None
+
+    # Flag. Clearing it turns auto-validation off; existing solves and the
+    # points they carry are left alone, since they were earned fairly.
+    if request.form.get('remove_flag') == 'on':
+        updates['flag'] = None
+    else:
+        flag = normalize_flag(request.form.get('flag', ''))
+        if flag and not is_valid_flag_format(flag):
+            return f"Invalid flag format. {FLAG_FORMAT_HINT}", None
+        updates['flag'] = flag or None
+
+    # Replacement source archive (reviewer-only, never published)
+    source_data = None
+    source_file = request.files.get('source_file')
+    if source_file and source_file.filename:
+        source_data = source_file.read()
+        if is_unsupported_archive(source_data):
+            return "Source archive must be a ZIP (RAR/tar are not supported)", None
+        if is_archive_password_protected(source_data):
+            return "Source archive must not be password-protected", None
+        updates['source_original_filename'] = secure_filename(source_file.filename) or "source"
+
+    changes = _describe_crackme_changes(crackme_obj, updates)
+    if source_data is not None:
+        changes.append("source archive replaced")
+
+    g_crackmesone_db.crackme.update_one(
+        {"_id": crackme_obj['_id']}, {"$set": updates}
+    )
+
+    if source_data is not None:
+        try:
+            os.makedirs(get_source_dir(), exist_ok=True)
+            with open(os.path.join(get_source_dir(), crackme_uuid), 'wb') as f:
+                f.write(source_data)
+        except OSError as e:
+            return f"Failed to save source archive: {e}", None
+
+    error = None
+    replaced, replace_error = _replace_crackme_file(crackme_obj, request)
+    if replaced:
+        changes.append("file replaced")
+    if replace_error:
+        error = replace_error
+
+    if not changes:
+        return error, "No changes were made"
+
+    log_reviewer_operation(
+        "edit_crackme_admin", current_user['username'],
+        {
+            "crackme_uuid": crackme_uuid,
+            "crackme_name": crackme_obj.get('name'),
+            "changes": changes
+        },
+        True
+    )
+
+    if notify_author and not error:
+        try:
+            change_summary = ", ".join(changes[:3])
+            if len(changes) > 3:
+                change_summary += f" and {len(changes) - 3} more"
+            send_user_notification(
+                crackme_obj['author'],
+                f"Your crackme '<a href=\"/crackme/{crackme_uuid}\">{html_escape(crackme_obj.get('name'))}</a>' has been updated by an admin: {html_escape(change_summary)}"
+            )
+        except Exception as e:
+            print(f"Notification error: {e}")
+
+    if error:
+        return error, None
+    return None, f"Crackme '{crackme_obj.get('name')}' updated successfully"
+
+
+def _describe_crackme_changes(crackme_obj, updates):
+    """Summarise an edit for the operation log and the author's notification.
+
+    The flag is reported as changed but never quoted: the log is mirrored to a
+    Discord channel, which is one more place a live flag doesn't need to be.
+    """
+    labels = ('description', 'language', 'arch', 'platform', 'labels',
+              'official difficulty')
+    fields = ('info', 'lang', 'arch', 'platform', 'labels', 'official_difficulty')
+
+    changes = []
+    for label, field in zip(labels, fields):
+        old, new = crackme_obj.get(field), updates[field]
+        if field == 'labels':
+            if sorted(old or []) != sorted(new):
+                changes.append(f"labels: {old or []} -> {new}")
+        elif old != new:
+            if field == 'info':
+                changes.append("description updated")
+            else:
+                changes.append(f"{label}: '{old}' -> '{new}'")
+
+    old_flag, new_flag = crackme_obj.get('flag'), updates['flag']
+    if old_flag != new_flag:
+        if not new_flag:
+            changes.append("flag removed (auto-validation off)")
+        elif not old_flag:
+            changes.append("flag set (auto-validation on)")
+        else:
+            changes.append("flag changed")
+
+    return changes
+
+
+def _replace_crackme_file(crackme_obj, request):
+    """Replace the downloadable crackme archive, if a new file was uploaded.
+
+    Returns:
+        Tuple of (replaced: bool, error: str or None).
+    """
+    file = request.files.get('file')
+    if not file or not file.filename:
+        return False, None
+
+    file_data = file.read()
+    if not file_data:
+        return False, None
+
+    temp_path = os.path.join(
+        CRACKMESONE_DIR, 'tmp',
+        f"replace_{crackme_obj['hexid']}_{file.filename}"
+    )
+    os.makedirs(os.path.dirname(temp_path), exist_ok=True)
+    with open(temp_path, 'wb') as f:
+        f.write(file_data)
+
+    dest_path = os.path.join(get_static_dir('crackme'), crackme_obj['hexid'])
+    old_zip = dest_path + ".zip"
+    if os.path.exists(old_zip):
+        os.remove(old_zip)
+
+    success, zip_error = create_password_protected_zip(
+        temp_path, dest_path, file.filename
+    )
+    if not success:
+        return False, f"Failed to replace file: {zip_error}"
+    return True, None
+
+
 @reviewer_bp.route('/delcomment', methods=['GET', 'POST'])
 @admin_required
 def delcomment(current_user):
@@ -2854,6 +3132,10 @@ def create_site_archive_background(requesting_user):
         set_archive_status('running', step='Exporting crackmes database...')
         crackmes = list(db.crackme.find({}))
         for c in crackmes:
+            # Flags are reviewer-only secrets and are not part of the public
+            # site archive. Omit the key entirely rather than exporting a
+            # placeholder value.
+            c.pop('flag', None)
             c['_id'] = str(c['_id'])
         with open(os.path.join(archive_folder, 'database', 'crackmes.json'), 'w') as f:
             json.dump(crackmes, f, indent=2, default=str)
diff --git a/review/templates/reviewer/_deletion_preview.html b/review/templates/reviewer/_deletion_preview.html
index 8e4e67c..5c0f57a 100644
--- a/review/templates/reviewer/_deletion_preview.html
+++ b/review/templates/reviewer/_deletion_preview.html
@@ -59,6 +59,14 @@
         <strong>{{ preview.solutions }} Solutions</strong> posted by user
     </div>
 
+    <div class="preview-item">
+        <strong>{{ preview.solves }} Solves</strong> by user (the points they earned go too)
+    </div>
+
+    <div class="preview-item">
+        <strong>{{ preview.flag_submissions }} Flag Submissions</strong> by user
+    </div>
+
     <div class="preview-item">
         <strong>{{ preview.user_comments }} Comments</strong> by user on other crackmes
     </div>
@@ -82,6 +90,7 @@
         <div class="cascade-info">
             -> {{ crackme.solutions }} solutions will be cascade deleted<br>
             -> {{ crackme.comments }} comments will be cascade deleted<br>
+            -> {{ crackme.solves }} solves by other users will be cascade deleted (they lose those points)<br>
             -> {{ crackme.difficulty_ratings }} difficulty ratings will be cascade deleted<br>
             -> {{ crackme.quality_ratings }} quality ratings will be cascade deleted
         </div>
@@ -99,6 +108,7 @@
             <li>{{ preview.solutions + preview.total_solutions_on_user_crackmes }} solutions ({{ preview.solutions }} by user + {{ preview.total_solutions_on_user_crackmes }} on user's crackmes)</li>
             <li>{{ preview.total_comments }} comments ({{ preview.user_comments }} by user + {{ preview.total_comments - preview.user_comments }} on user's crackmes)</li>
             <li>{{ preview.crackmes }} crackmes</li>
+            <li>{{ preview.solves }} solves by user</li>
             <li>Difficulty/quality ratings will be recalculated for affected crackmes</li>
         </ul>
     </div>
diff --git a/review/templates/reviewer/dashboard.html b/review/templates/reviewer/dashboard.html
index a3ce053..07eecab 100644
--- a/review/templates/reviewer/dashboard.html
+++ b/review/templates/reviewer/dashboard.html
@@ -31,6 +31,7 @@ <h2>Welcome, {{ user }}!{% if is_admin %} (Admin){% endif %}</h2>
                 <a href="{{ url_for('reviewer.labelrequests') }}" class="btn btn-link">Review label requests</a>
                 <a href="{{ url_for('reviewer.accountdeletionrequests') }}" class="btn btn-link">Account deletion requests</a>
                 {% if is_admin %}
+                <a href="{{ url_for('reviewer.flagvalidations') }}" class="btn btn-link">Review flag validations</a>
                 <a href="{{ url_for('reviewer.deletesolution') }}" class="btn btn-link">Delete solution</a>
                 <a href="{{ url_for('reviewer.deletecrackme') }}" class="btn btn-link">Delete crackme</a>
                 <a href="{{ url_for('reviewer.editcrackme') }}" class="btn btn-link">Edit crackme</a>
@@ -74,6 +75,7 @@ <h2 class="text-center"> {{ acctdel_cnt }} </h2><br>
                 </div>
             </div>
         </div>
+
     </div>
 
 </body>
diff --git a/review/templates/reviewer/editcrackme.html b/review/templates/reviewer/editcrackme.html
index 0919b9e..88b71f9 100644
--- a/review/templates/reviewer/editcrackme.html
+++ b/review/templates/reviewer/editcrackme.html
@@ -33,7 +33,12 @@ <h2>Welcome, {{ user }}!{% if is_admin %} (Admin){% endif %}</h2>
 
         {% if crackme %}
         <h3>Edit crackme: "{{ crackme.name }}" by {{ crackme.author }}</h3>
+        {% if crackme.visible %}
         <p>View on site: <a href="https://crackmes.one/crackme/{{ crackme.hexid }}" target="_blank">{{ crackme.name }}</a></p>
+        {% else %}
+        <p>Still pending review &mdash; not visible on the site yet.
+            <a href="{{ url_for('reviewer.viewcrackme', crackme_uuid=crackme.hexid) }}">Review it</a>.</p>
+        {% endif %}
 
         <div class="columns panel-background">
             <div class="column col-12">
@@ -46,51 +51,46 @@ <h3>Edit crackme: "{{ crackme.name }}" by {{ crackme.author }}</h3>
                         <input class="form-input" type="text" value="{{ crackme.name }}" disabled>
                     </div>
 
+                    {# Option lists come from app/services/crackme_fields.py (injected app-wide),
+                       so the reviewer form can't drift from the upload form. #}
                     <div class="form-group">
                         <label class="form-label" for="lang">Language</label>
                         <select class="form-select" id="lang" name="lang">
-                            <option value="C/C++" {{ 'selected' if crackme.lang == 'C/C++' else '' }}>C/C++</option>
-                            <option value="Assembler" {{ 'selected' if crackme.lang == 'Assembler' else '' }}>Assembler</option>
-                            <option value="Java" {{ 'selected' if crackme.lang == 'Java' else '' }}>Java</option>
-                            <option value="Go" {{ 'selected' if crackme.lang == 'Go' else '' }}>Go</option>
-                            <option value="Rust" {{ 'selected' if crackme.lang == 'Rust' else '' }}>Rust</option>
-                            <option value="WebAssembly" {{ 'selected' if crackme.lang == 'WebAssembly' else '' }}>WebAssembly</option>
-                            <option value="Python" {{ 'selected' if crackme.lang == 'Python' else '' }}>Python</option>
-                            <option value="AutoIt" {{ 'selected' if crackme.lang == 'AutoIt' else '' }}>AutoIt</option>
-                            <option value="(Visual) Basic" {{ 'selected' if crackme.lang == '(Visual) Basic' else '' }}>(Visual) Basic</option>
-                            <option value="Borland Delphi" {{ 'selected' if crackme.lang == 'Borland Delphi' else '' }}>Borland Delphi</option>
-                            <option value="Turbo Pascal" {{ 'selected' if crackme.lang == 'Turbo Pascal' else '' }}>Turbo Pascal</option>
-                            <option value=".NET" {{ 'selected' if crackme.lang == '.NET' else '' }}>.NET</option>
-                            <option value="Unspecified/other" {{ 'selected' if crackme.lang == 'Unspecified/other' else '' }}>Unspecified/other</option>
+                            {% for choice in LANG_CHOICES %}
+                            <option value="{{ choice }}" {{ 'selected' if crackme.lang == choice else '' }}>{{ choice }}</option>
+                            {% endfor %}
                         </select>
                     </div>
 
                     <div class="form-group">
                         <label class="form-label" for="arch">Arch</label>
                         <select class="form-select" id="arch" name="arch">
-                            <option value="x86" {{ 'selected' if crackme.arch == 'x86' else '' }}>x86</option>
-                            <option value="x86-64" {{ 'selected' if crackme.arch == 'x86-64' else '' }}>x86-64</option>
-                            <option value="java" {{ 'selected' if crackme.arch == 'java' else '' }}>java</option>
-                            <option value="ARM" {{ 'selected' if crackme.arch == 'ARM' else '' }}>ARM</option>
-                            <option value="MIPS" {{ 'selected' if crackme.arch == 'MIPS' else '' }}>MIPS</option>
-                            <option value="RISC-V" {{ 'selected' if crackme.arch == 'RISC-V' else '' }}>RISC-V</option>
-                            <option value="other" {{ 'selected' if crackme.arch == 'other' else '' }}>other</option>
+                            {% for choice in ARCH_CHOICES %}
+                            <option value="{{ choice }}" {{ 'selected' if crackme.arch == choice else '' }}>{{ choice }}</option>
+                            {% endfor %}
                         </select>
                     </div>
 
                     <div class="form-group">
                         <label class="form-label" for="platform">Platform</label>
                         <select class="form-select" id="platform" name="platform">
-                            <option value="Mac OS X" {{ 'selected' if crackme.platform == 'Mac OS X' else '' }}>Mac OS X</option>
-                            <option value="Multiplatform" {{ 'selected' if crackme.platform == 'Multiplatform' else '' }}>Multiplatform</option>
-                            <option value="Unix/linux etc." {{ 'selected' if crackme.platform == 'Unix/linux etc.' else '' }}>Unix/linux etc.</option>
-                            <option value="Windows" {{ 'selected' if crackme.platform == 'Windows' else '' }}>Windows</option>
-                            <option value="Android" {{ 'selected' if crackme.platform == 'Android' else '' }}>Android</option>
-                            <option value="iOS" {{ 'selected' if crackme.platform == 'iOS' else '' }}>iOS</option>
-                            <option value="Unspecified/other" {{ 'selected' if crackme.platform == 'Unspecified/other' else '' }}>Unspecified/other</option>
+                            {% for choice in PLATFORM_CHOICES %}
+                            <option value="{{ choice }}" {{ 'selected' if crackme.platform == choice else '' }}>{{ choice }}</option>
+                            {% endfor %}
                         </select>
                     </div>
 
+                    <div class="form-group">
+                        <label class="form-label" for="official_points">Points</label>
+                        <input class="form-input" type="number" id="official_points" name="official_points"
+                               min="100" max="600" step="1"
+                               value="{{ (crackme.official_difficulty * 100)|round|int if crackme.official_difficulty else '' }}">
+                        <p class="form-input-hint">
+                            Whole numbers from 100 to 600. Stored internally as points &divide; 100; already-earned
+                            points are not re-priced.
+                        </p>
+                    </div>
+
                     <div class="form-group">
                         <label class="form-label" for="info">Description</label>
                         <textarea class="form-input" id="info" name="info" rows="5">{{ crackme.info }}</textarea>
@@ -105,6 +105,35 @@ <h3>Edit crackme: "{{ crackme.name }}" by {{ crackme.author }}</h3>
 
                     <div class="divider"></div>
 
+                    <div class="form-group">
+                        <label class="form-label" for="flag">Flag</label>
+                        <input class="form-input" type="text" id="flag" name="flag" value="{{ crackme.flag }}"
+                               placeholder="{{ flag_format_hint }}">
+                        <p class="form-input-hint">
+                            The flag solvers submit for points. Leave empty (or tick below) and this crackme accepts no
+                            flag submissions at all. Setting one on a crackme that had none turns auto-validation on.
+                            Existing solves keep the points they earned either way.
+                        </p>
+                        <label class="form-checkbox">
+                            <input type="checkbox" name="remove_flag">
+                            <i class="form-icon"></i> Remove the flag (turn auto-validation off)
+                        </label>
+                    </div>
+
+                    <div class="form-group">
+                        <label class="form-label" for="source_file">Private source archive</label>
+                        {% if crackme.source_original_filename %}
+                        <p class="form-input-hint">
+                            Current: <a href="{{ url_for('reviewer.downloadreview', uuid=crackme.hexid, type='source') }}">{{ crackme.source_original_filename }}</a>
+                            &mdash; reviewers only, never published.
+                        </p>
+                        {% else %}
+                        <p class="form-input-hint">No source archive on file.</p>
+                        {% endif %}
+                        <input class="form-input" type="file" id="source_file" name="source_file">
+                        <p class="form-input-hint">Upload a zip to replace it. Leave empty to keep the current one.</p>
+                    </div>
+
                     <div class="form-group">
                         <label class="form-label" for="file">Replace file (optional)</label>
                         <input class="form-input" type="file" id="file" name="file">
diff --git a/review/templates/reviewer/flagvalidations.html b/review/templates/reviewer/flagvalidations.html
new file mode 100644
index 0000000..f5fc125
--- /dev/null
+++ b/review/templates/reviewer/flagvalidations.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Review flag validations</title>
+    <link rel="stylesheet" href="{{ url_for('static', filename='css/spectre.min.css') }}">
+    <link rel="stylesheet" href="{{ url_for('static', filename='css/spectre-exp.min.css') }}">
+    <link rel="stylesheet" href="{{ url_for('static', filename='css/spectre-icons.min.css') }}">
+    <link rel="stylesheet" href="{{ url_for('static', filename='css/custom.css') }}">
+</head>
+<body>
+    <header class="navbar hide-xs">
+        <section class="navbar-section">
+            <h2><a href="{{ url_for('reviewer.dashboard') }}" class="title-navbar">Dashboard</a></h2>
+        </section>
+        <section class="navbar-center"><h2>Review flag validations</h2></section>
+        <section class="navbar-section">
+            <a href="/" class="btn btn-link">crackmes.one</a>
+            <a href="{{ url_for('reviewer.logout') }}" class="btn btn-link">Logout</a>
+        </section>
+    </header>
+
+    <div class="container grid-xl wrapper">
+        <div class="panel-background">
+            {% if submissions %}
+            <table class="table table-striped">
+                <thead>
+                    <tr><th>User</th><th>Crackme</th><th>Submitted flag</th><th>Result</th><th>Submitted</th></tr>
+                </thead>
+                <tbody>
+                {% for submission in submissions %}
+                    <tr>
+                        <td>{{ submission.username }}</td>
+                        <td>
+                            {% if submission.crackme_name != 'Deleted crackme' %}
+                            <a href="{{ url_for('reviewer.viewcrackme', crackme_uuid=submission.crackme_hexid) }}">{{ submission.crackme_name }}</a>
+                            {% else %}
+                            {{ submission.crackme_name }}
+                            {% endif %}
+                        </td>
+                        <td><code>{{ submission.submitted_flag }}</code></td>
+                        <td>{{ submission.result|replace('_', ' ')|title }}</td>
+                        <td>{{ submission.created_at }}</td>
+                    </tr>
+                {% endfor %}
+                </tbody>
+            </table>
+            {% else %}
+            <p>No flag submissions have been recorded.</p>
+            {% endif %}
+        </div>
+    </div>
+</body>
+</html>
diff --git a/review/templates/reviewer/viewcrackme.html b/review/templates/reviewer/viewcrackme.html
index 02e047a..7bb416a 100644
--- a/review/templates/reviewer/viewcrackme.html
+++ b/review/templates/reviewer/viewcrackme.html
@@ -1,22 +1,16 @@
 <!DOCTYPE html>
 <html>
-
 <head>
-    <title>View crackme</title>
+    <title>Review crackme</title>
     <link rel="stylesheet" href="{{ url_for('static', filename='css/spectre.min.css') }}">
     <link rel="stylesheet" href="{{ url_for('static', filename='css/spectre-exp.min.css') }}">
     <link rel="stylesheet" href="{{ url_for('static', filename='css/spectre-icons.min.css') }}">
     <link rel="stylesheet" href="{{ url_for('static', filename='css/custom.css') }}">
 </head>
-
 <body>
     <header class="navbar hide-xs">
-        <section class="navbar-section">
-            <h2><a href="{{ url_for('reviewer.dashboard') }}" class="title-navbar">Dashboard</a></h2>
-        </section>
-        <section class="navbar-center">
-            <h2>Welcome, {{ user }}!{% if is_admin %} (Admin){% endif %}</h2>
-        </section>
+        <section class="navbar-section"><h2><a href="{{ url_for('reviewer.dashboard') }}" class="title-navbar">Dashboard</a></h2></section>
+        <section class="navbar-center"><h2>Welcome, {{ user }}!{% if is_admin %} (Admin){% endif %}</h2></section>
         <section class="navbar-section">
             <a href="/" class="btn btn-link">crackmes.one</a>
             <a href="{{ url_for('reviewer.logout') }}" class="btn btn-link">Logout</a>
@@ -24,60 +18,92 @@ <h2>Welcome, {{ user }}!{% if is_admin %} (Admin){% endif %}</h2>
     </header>
 
     <div class="container grid-lg wrapper">
-        <h3>
-            <p><strong>"{{ crackme.name }}"</strong> by <a href="https://crackmes.one/user/{{crackme.author}}">{{ crackme.author }}</a></p>
-        </h3>
+        <h3><strong>"{{ crackme.name }}"</strong> by <a href="/user/{{ crackme.author }}">{{ crackme.author }}</a></h3>
+        {% if message %}<div class="toast">{{ message }}</div>{% endif %}
+        <div id="change-status" class="toast toast-warning" style="display:none; margin-bottom:12px;">You have unsaved review changes.</div>
+
         <div class="columns panel-background">
             <div class="column col-12">
-                <h3>
-                    <p>Crackme info</p>
-                </h3>
-                <p><span style="white-space: pre-line"> Language: {{ crackme.lang }}</span></p>
-                <p><span style="white-space: pre-line"> Arch: {{ crackme.arch }}</span></p>
-                <p><span style="white-space: pre-line"> Platform: {{ crackme.platform }}</span></p>
-                <div class="divider"></div>
-                <h3>
-                    <p>Description</p>
-                </h3>
-                <p><span style="white-space: pre-line">{{ crackme.info }}</span></p>
-                <div class="divider"></div>
-                <h3>
-                    <p>Download</p>
-                </h3>
-
-                <a href="{{ url_for('reviewer.downloadreview', uuid=crackme.crackme_uuid, type='crackme') }}">Download</a>
-                <div class="divider"></div>
-
-                <h3>
-                    <p>Labels</p>
-                </h3>
-                <p>Author-suggested / current labels. Adjust and save before accepting.</p>
-                <form action="{{ url_for('reviewer.setlabels') }}" method="POST">
+                <form id="review-edit-form" action="{{ url_for('reviewer.approvecrackme') }}" method="POST">
                     <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                     <input type="hidden" name="uuid" value="{{ crackme.crackme_uuid }}">
-                    <input type="hidden" name="redirect_to" value="view">
+
+                    <h3>Crackme info</h3>
+                    <div class="columns">
+                        <div class="column col-3 col-sm-12 form-group">
+                            <label class="form-label" for="lang">Language</label>
+                            <select class="form-select" id="lang" name="lang">
+                                {% if crackme.lang not in LANG_CHOICES %}<option value="{{ crackme.lang }}" selected>{{ crackme.lang }} (legacy)</option>{% endif %}
+                                {% for choice in LANG_CHOICES %}<option value="{{ choice }}"{{ ' selected' if crackme.lang == choice else '' }}>{{ choice }}</option>{% endfor %}
+                            </select>
+                        </div>
+                        <div class="column col-3 col-sm-12 form-group">
+                            <label class="form-label" for="arch">Architecture</label>
+                            <select class="form-select" id="arch" name="arch">
+                                {% if crackme.arch not in ARCH_CHOICES %}<option value="{{ crackme.arch }}" selected>{{ crackme.arch }} (legacy)</option>{% endif %}
+                                {% for choice in ARCH_CHOICES %}<option value="{{ choice }}"{{ ' selected' if crackme.arch == choice else '' }}>{{ choice }}</option>{% endfor %}
+                            </select>
+                        </div>
+                        <div class="column col-3 col-sm-12 form-group">
+                            <label class="form-label" for="platform">Platform</label>
+                            <select class="form-select" id="platform" name="platform">
+                                {% if crackme.platform not in PLATFORM_CHOICES %}<option value="{{ crackme.platform }}" selected>{{ crackme.platform }} (legacy)</option>{% endif %}
+                                {% for choice in PLATFORM_CHOICES %}<option value="{{ choice }}"{{ ' selected' if crackme.platform == choice else '' }}>{{ choice }}</option>{% endfor %}
+                            </select>
+                        </div>
+                        <div class="column col-3 col-sm-12 form-group">
+                            <label class="form-label" for="official_points">Points</label>
+                            <input class="form-input" type="number" id="official_points" name="official_points" min="100" max="600" step="1"
+                                   value="{{ (crackme.official_difficulty * 100)|round|int if crackme.official_difficulty else '' }}"
+                                   {% if crackme.auto_validation %}required{% else %}disabled{% endif %}>
+                        </div>
+                    </div>
+
+                    <div class="form-group">
+                        <label class="form-label" for="info">Description</label>
+                        <textarea class="form-input" id="info" name="info" rows="6" required>{{ crackme.info }}</textarea>
+                    </div>
+
+                    <div class="divider"></div>
+                    <h3>Download</h3>
+                    <p><a href="{{ url_for('reviewer.downloadreview', uuid=crackme.crackme_uuid, type='crackme') }}">Download crackme</a></p>
+
+                    <div class="divider"></div>
+                    <h3>Auto-validation</h3>
+                    {% if crackme.auto_validation %}
+                    <p>This crackme will accept a flag and award the point value shown above.</p>
+                    {% if crackme.has_source_archive %}
+                    <p><a href="{{ url_for('reviewer.downloadreview', uuid=crackme.crackme_uuid, type='source') }}">Download private verification ZIP</a></p>
+                    {% else %}
+                    <p><strong>No verification ZIP was uploaded.</strong></p>
+                    {% endif %}
+                    <div class="form-group">
+                        <label class="form-label" for="flag">Flag</label>
+                        <input class="form-input" type="text" id="flag" name="flag" value="{{ crackme.flag }}" required>
+                    </div>
+                    {% else %}
+                    <p>The author did not enable auto-validation.</p>
+                    {% endif %}
+
+                    <div class="divider"></div>
+                    <h3>Labels</h3>
+                    <p>Adjust the author-suggested labels before approval.</p>
+                    <input type="hidden" name="labels_submitted" value="1">
                     <div class="form-group" id="view-labels">
                         {% set label_input_name = 'labels' %}
                         {% set checked_labels = crackme.labels %}
                         {% include 'partial/labels_checkboxes.html' %}
                     </div>
-                    <button type="submit" class="btn">Save labels</button>
                 </form>
-                <script src="{{ url_for('static', filename='js/label_checkboxes.js') }}"></script>
-                <script>LabelCheckboxes.init(document.getElementById('view-labels'));</script>
-                <div class="divider"></div>
-
-                <h3>
-                    <p>Review</p>
-                </h3>
 
-                <form action="{{ url_for('reviewer.rejectcrackme') }}" method="POST">
+                <div class="divider"></div>
+                <h3>Review</h3>
+                <form id="reject-form" action="{{ url_for('reviewer.rejectcrackme') }}" method="POST">
                     <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
-                    <input type="hidden" name="uuid" value="{{crackme.crackme_uuid}}">
-
+                    <input type="hidden" name="uuid" value="{{ crackme.crackme_uuid }}">
                     <div class="form-group">
                         <label class="form-label">Reject reason</label>
-                        <select class="form-select" id="preset_reason_crackme" onchange="updateRejectReason('crackme')">
+                        <select class="form-select" id="preset_reason_crackme" onchange="updateRejectReason()">
                             <option value="">-- Select a reason or type custom --</option>
                             <option value="This is commercial software or a game cheat, not an educational crackme">Commercial software / game cheat</option>
                             <option value="File is corrupted or doesn't execute properly">File corrupted / doesn't run</option>
@@ -86,38 +112,41 @@ <h3>
                             <option value="Password-protected archive - do NOT add a password, the server handles this automatically">Password-protected archive</option>
                             <option value="Duplicate submission - you already have a crackme with this name pending or approved">Duplicate submission</option>
                             <option value="File too large or archive contains unnecessary files">File size / unnecessary files</option>
-                            <option value="custom">Other (type custom reason below)</option>
+                            <option value="custom">Other</option>
                         </select>
                     </div>
-
-                    <div class="form-group">
-                        <input class="form-input" type="text" id="reject_reason_crackme" name="reject_reason" placeholder="Custom reason (or selected reason appears here)">
-                    </div>
-
-                    <div style="margin-top: 15px;">
-                        <button type="submit" class="btn active float-right">Reject</button>
-                    </div>
+                    <div class="form-group"><input class="form-input" type="text" id="reject_reason_crackme" name="reject_reason" placeholder="Custom reason"></div>
                 </form>
 
-                <script>
-                function updateRejectReason(type) {
-                    var select = document.getElementById('preset_reason_' + type);
-                    var input = document.getElementById('reject_reason_' + type);
-                    if (select.value && select.value !== 'custom') {
-                        input.value = select.value;
-                    } else if (select.value === 'custom') {
-                        input.value = '';
-                        input.focus();
-                    }
-                }
-                </script>
-
-                <form action="{{ url_for('reviewer.approvecrackme') }}" method="POST">
-                    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
-                    <input type="hidden" name="uuid" value="{{crackme.crackme_uuid}}">
-                    <button type="submit" class="btn active float-left">Accept</button>
-                </form>
+                <div style="display:flex; gap:8px; align-items:center; margin-top:15px;">
+                    <button type="submit" form="review-edit-form" class="btn active">Approve</button>
+                    <button type="button" id="discard-changes" class="btn" disabled>Discard changes</button>
+                    <button type="submit" form="reject-form" class="btn btn-error">Reject</button>
+                </div>
             </div>
         </div>
     </div>
+
+    <script src="{{ url_for('static', filename='js/label_checkboxes.js') }}"></script>
+    <script>
+    LabelCheckboxes.init(document.getElementById('view-labels'));
+    (function() {
+        var form = document.getElementById('review-edit-form');
+        var status = document.getElementById('change-status');
+        var discard = document.getElementById('discard-changes');
+        function setDirty() { status.style.display = 'block'; discard.disabled = false; }
+        function setClean() { status.style.display = 'none'; discard.disabled = true; }
+        form.addEventListener('input', setDirty);
+        form.addEventListener('change', setDirty);
+        discard.addEventListener('click', function() { form.reset(); setTimeout(setClean, 0); });
+    })();
+
+    function updateRejectReason() {
+        var select = document.getElementById('preset_reason_crackme');
+        var input = document.getElementById('reject_reason_crackme');
+        if (select.value && select.value !== 'custom') input.value = select.value;
+        else if (select.value === 'custom') { input.value = ''; input.focus(); }
+    }
+    </script>
 </body>
+</html>
diff --git a/templates/crackme/create.html b/templates/crackme/create.html
index 9bfd1c3..b7b6e1a 100644
--- a/templates/crackme/create.html
+++ b/templates/crackme/create.html
@@ -23,6 +23,11 @@ <h3>Quick Rules</h3>
     <p>Read the full <a href="/upload/crackmerules">crackme submission rules</a> for detailed guidelines.</p>
 
     <div class="divider"></div>
+    {# ``form`` carries back what the user typed when a submission is rejected, so a
+       missing field never costs them the rest of the form. Defaults double as the
+       first-visit state. #}
+    {% set form = form|default({}) %}
+    <div id="upload-errors" class="toast toast-error" style="display: none;"></div>
     <form id="upload-form" class="form-horizontal" action="/upload/crackme" method="post" enctype="multipart/form-data">
         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
         <div class="form-group">
@@ -30,7 +35,7 @@ <h3>Quick Rules</h3>
                 <label class="form-label" for="name">Crackme name</label>
             </div>
             <div class="col-9 col-sm-12">
-                <input class="form-input" type="text" id="name" name="name" placeholder="Name">
+                <input class="form-input" type="text" id="name" name="name" placeholder="Name" value="{{ form.name|default('') }}">
             </div>
         </div>
         <div class="form-group">
@@ -41,7 +46,7 @@ <h3>Quick Rules</h3>
                 {% set choice_type = 'radio' %}
                 {% set choice_name = 'difficulty' %}
                 {% set choice_options = DIFFICULTY_CHOICES %}
-                {% set choice_selected = '' %}
+                {% set choice_selected = form.difficulty|default('') %}
                 {% include 'partial/choice_inputs.html' %}
             </div>
         </div>
@@ -53,7 +58,7 @@ <h3>Quick Rules</h3>
                 {% set choice_type = 'radio' %}
                 {% set choice_name = 'lang' %}
                 {% set choice_options = LANG_CHOICES %}
-                {% set choice_selected = '' %}
+                {% set choice_selected = form.lang|default('') %}
                 {% include 'partial/choice_inputs.html' %}
             </div>
         </div>
@@ -65,7 +70,7 @@ <h3>Quick Rules</h3>
                 {% set choice_type = 'radio' %}
                 {% set choice_name = 'arch' %}
                 {% set choice_options = ARCH_CHOICES %}
-                {% set choice_selected = '' %}
+                {% set choice_selected = form.arch|default('') %}
                 {% include 'partial/choice_inputs.html' %}
             </div>
         </div>
@@ -77,54 +82,167 @@ <h3>Quick Rules</h3>
                 {% set choice_type = 'radio' %}
                 {% set choice_name = 'platform' %}
                 {% set choice_options = PLATFORM_CHOICES %}
-                {% set choice_selected = '' %}
+                {% set choice_selected = form.platform|default('') %}
                 {% include 'partial/choice_inputs.html' %}
             </div>
         </div>
+        <div class="form-group">
+            <div class="col-3">
+                <label class="form-label" for="input-upload">File</label>
+            </div>
+            <div class="col-9">
+                <input class="form-input upload-btn" type="file" id="file" name="file">
+            </div>
+        </div>
         <div class="form-group">
             <div class="col-3 col-sm-12">
-                <label class="form-label">Labels</label>
+                <label class="form-label" for="info">Info</label>
             </div>
             <div class="col-9 col-sm-12">
-                <p class="text-gray" style="font-size: 0.8rem; margin-bottom: 6px;">
-                    Select the anti-analysis / obfuscation techniques your crackme uses. Please label every technique
-                    that applies; if none apply, it's fine to leave these empty. Pick a broad category and, where it
-                    applies, the specific technique underneath &mdash; ticking a technique ticks its category
-                    automatically. Reviewers may adjust these later.
-                </p>
-                <div class="choice-box">
-                    {% set label_input_name = 'labels' %}
-                    {% set checked_labels = [] %}
-                    {% include 'partial/labels_checkboxes.html' %}
-                </div>
+                <textarea class="form-input" id="info" name="info" placeholder="Textarea" rows="3">{{ form.info|default('') }}</textarea>
             </div>
         </div>
         <div class="form-group">
-            <div class="col-3">
-                <label class="form-label" for="input-upload">File</label>
+            <div class="col-3 col-sm-12">
+                <label class="form-label">Auto-validation</label>
             </div>
-            <div class="col-9">
-                <input class="form-input upload-btn" type="file" id="file" name="file">
+            <div class="col-9 col-sm-12">
+                <label class="form-checkbox">
+                    <input type="checkbox" id="auto_validation" name="auto_validation"{{ '' if form and not form.auto_validation else ' checked' }}>
+                    <i class="form-icon"></i> Optional. This crackme has a unique flag and can be auto-validated.
+                </label>
+                <div id="auto-validation-fields" style="display: none;">
+                    <p class="text-gray" style="font-size: 0.8rem; margin: 6px 0;">
+                        Players submit the flag to earn points. Only reviewers can see it.
+                    </p>
+                    <input class="form-input" type="text" id="flag" name="flag" placeholder="CMO{your_crackmes_flag}" value="{{ form.flag|default('') }}">
+                    <label class="form-label" for="points" style="margin-top: 8px;">Points</label>
+                    <input class="form-input" type="number" id="points" name="points" min="100" max="600" step="1" value="{{ form.points|default('') }}">
+                    <p class="form-input-hint">Defaults to difficulty &times; 100. You may choose any whole number from 100 to 600.</p>
+                    <p class="text-gray" style="font-size: 0.8rem; margin: 6px 0;">
+                        Upload a ZIP containing source code, build files, a writeup, or anything else needed to verify the flag.
+                        <b>Reviewers only</b> &mdash; it remains private.
+                    </p>
+                    <input class="form-input upload-btn" type="file" id="source" name="source">
+                </div>
             </div>
         </div>
         <div class="form-group">
             <div class="col-3 col-sm-12">
-                <label class="form-label" for="info">Info</label>
+                <label class="form-label">Labels</label>
             </div>
             <div class="col-9 col-sm-12">
-                <textarea class="form-input" id="info" name="info" placeholder="Textarea" rows="3"></textarea>
+                <p class="text-gray" style="font-size: 0.8rem; margin-bottom: 6px;">
+                    Select all anti-analysis and obfuscation techniques used. Specific techniques automatically select
+                    their category, and reviewers may adjust labels. Labels on active auto-validated crackmes remain
+                    hidden until scoring ends.
+                </p>
+                <div class="choice-box">
+                    {% set label_input_name = 'labels' %}
+                    {% set checked_labels = form.labels|default([]) %}
+                    {% include 'partial/labels_checkboxes.html' %}
+                </div>
             </div>
         </div>
         {% if RECAPTCHA_SITEKEY %}
         <div class="g-recaptcha float-right" data-sitekey="{{ RECAPTCHA_SITEKEY }}"></div>
         </br></br></br></br>
         {% endif %}
-        <input type="submit" class="btn active float-right" value="Upload a crackme">
+        <input type="submit" id="upload-submit" class="btn active float-right" value="Upload a crackme">
     </form>
 </div>
 
 <script src="{{ url_for('static', filename='js/label_checkboxes.js') }}"></script>
 <script>LabelCheckboxes.init(document.getElementById('upload-form'));</script>
+<script>
+(function() {
+    // The flag and source inputs only mean anything once auto-validation is
+    // ticked, so keep them out of the way until then.
+    var toggle = document.getElementById('auto_validation');
+    var fields = document.getElementById('auto-validation-fields');
+    if (!toggle || !fields) return;
+    var points = document.getElementById('points');
+    var difficultyInputs = document.querySelectorAll('input[name="difficulty"]');
+    var pointsOverridden = !!(points && points.value);
+    function selectedDifficulty() {
+        var selected = document.querySelector('input[name="difficulty"]:checked');
+        return selected ? parseInt(selected.value, 10) : null;
+    }
+    function setDefaultPoints() {
+        var difficulty = selectedDifficulty();
+        if (points && difficulty && !pointsOverridden) points.value = difficulty * 100;
+    }
+    function sync() {
+        fields.style.display = toggle.checked ? 'block' : 'none';
+        if (toggle.checked) setDefaultPoints();
+    }
+    if (points) points.addEventListener('input', function() { pointsOverridden = true; });
+    difficultyInputs.forEach(function(input) {
+        input.addEventListener('change', setDefaultPoints);
+    });
+    toggle.addEventListener('change', sync);
+    sync();
+})();
+
+(function() {
+    // Submit in the background so a rejected upload only costs the user an error
+    // message: the form -- including the files they picked, which no server-side
+    // re-render can restore -- stays exactly as it was, ready to fix and resend.
+    // Without JS the form posts normally and the server re-renders it with the
+    // typed values instead (files excepted).
+    var form = document.getElementById('upload-form');
+    var button = document.getElementById('upload-submit');
+    var errors = document.getElementById('upload-errors');
+    if (!form || !button || !errors || !window.FormData || !window.fetch) return;
+
+    function showError(text) {
+        errors.textContent = text;
+        errors.style.display = 'block';
+        errors.scrollIntoView({ block: 'center' });
+        // A used reCAPTCHA token is spent, so the widget needs a fresh one
+        // before the user can try again.
+        if (window.grecaptcha) { try { window.grecaptcha.reset(); } catch (e) {} }
+    }
+
+    form.addEventListener('submit', function(e) {
+        e.preventDefault();
+        errors.style.display = 'none';
+        button.disabled = true;
+        button.value = 'Uploading...';
+
+        fetch(form.action, {
+            method: 'POST',
+            body: new FormData(form),
+            headers: { 'X-Requested-With': 'XMLHttpRequest' },
+            credentials: 'same-origin'
+        }).then(function(response) {
+            return response.json().then(function(data) {
+                return { ok: response.ok, status: response.status, data: data };
+            }).catch(function() {
+                return { ok: response.ok, status: response.status, data: null };
+            });
+        }).then(function(result) {
+            if (result.ok && result.data && result.data.redirect) {
+                window.location = result.data.redirect;
+                return;
+            }
+            if (result.data && result.data.error) {
+                showError(result.data.error);
+            } else if (result.status === 429) {
+                showError('You have hit the daily upload limit. Please try again later.');
+            } else {
+                showError('Upload failed (error ' + result.status + '). Please try again.');
+            }
+            button.disabled = false;
+            button.value = 'Upload a crackme';
+        }).catch(function() {
+            showError('Upload failed: could not reach the server. Please try again.');
+            button.disabled = false;
+            button.value = 'Upload a crackme';
+        });
+    });
+})();
+</script>
 
 {% include 'partial/footer.html' %}
 {% endblock %}
diff --git a/templates/crackme/read.html b/templates/crackme/read.html
index a976217..0464f7b 100644
--- a/templates/crackme/read.html
+++ b/templates/crackme/read.html
@@ -159,14 +159,18 @@ <h3><a href="/user/{{ username }}">{{ username }}</a>'s {{ name }}</h3>
             {{ platform }}</p>
         </div>
         <div class="column col-3">
+            {% if auto_validation %}
+            <p>Points:<br> {{ solve_points }}</p>
+            {% else %}
             <p>Difficulty:<br> {{ difficulty }}
             {% if AuthLevel == "auth" %}
             <a href="#" onclick="openModal('rate-diff'); return false;">Rate!</a></p>
             {% endif %}
+            {% endif %}
         </div>
         <div class="column col-3">
             <p>Quality:<br> {{ quality }}
-            {% if AuthLevel == "auth" %}
+            {% if AuthLevel == "auth" and (not auto_validation or user_solve) %}
             <a href="#" onclick="openModal('rate-qual'); return false;">Rate!</a></p>
             {% endif %}
         </div>
@@ -181,12 +185,19 @@ <h3><a href="/user/{{ username }}">{{ username }}</a>'s {{ name }}</h3>
             <p>Size:<br> {{ size|FILESIZE }}</p>
         </div>
         <div class="column col-3">
+            {% if auto_validation %}
+            <p>Solves:<br> {{ nbsolves }}</p>
+            {% else %}
             <p>Writeups:<br> {{ nbsolutions }}</p>
+            {% endif %}
         </div>
         <div class="column col-3">
+            {% if auto_validation %}
+            <p>Attempts:<br> {{ nbattempts }}</p>
+            {% else %}
             <p>Comments:<br> {{ nbcomments }}</p>
+            {% endif %}
         </div>
-
         <div class="column col-12">
             <div class="divider"></div>
         </div>
@@ -197,6 +208,31 @@ <h3><a href="/user/{{ username }}">{{ username }}</a>'s {{ name }}</h3>
             <div class="divider"></div>
         </div>
 
+        {% if auto_validation %}
+        <div class="column col-12">
+            <p><b>Flag</b></p>
+            {% if user_solve %}
+            <p class="text-success">
+                <b>Solved!</b> You cracked this on {{ user_solve.created_at|PRETTYTIME }} for {{ user_solve.points }} points.
+            </p>
+            {% elif usersess == username %}
+            <p class="text-gray">This is your crackme &mdash; you can't submit its flag.</p>
+            {% elif AuthLevel == "auth" %}
+            <form action="/crackme/{{ hexid }}/solve" method="post" class="form-horizontal">
+                <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+                <div class="input-group" style="max-width: 480px;">
+                    <input class="form-input" type="text" name="flag" placeholder="{{ flag_format_hint }}" autocomplete="off">
+                    <input type="submit" class="btn active input-group-btn" value="Submit flag">
+                </div>
+            </form>
+            {% else %}
+            <p><a href="/login">Log in</a> to submit the flag.</p>
+            {% endif %}
+            <div class="divider"></div>
+        </div>
+        {% endif %}
+
+        {% if not auto_validation %}
         <div class="column col-12">
             <p>
                 <b>Labels</b>
@@ -229,18 +265,53 @@ <h3><a href="/user/{{ username }}">{{ username }}</a>'s {{ name }}</h3>
             </div>
             <div class="divider"></div>
         </div>
+        {% endif %}
 
         <div class="column col-4" style="margin-bottom:20px;">
             <ul class="tab tab-block" style="border-bottom: .05rem solid transparent;">
+                {% if auto_validation %}
+                <li class="tab-item active">
+                    <a>Solves ({{ nbsolves }})</a>
+                </li>
+                {% else %}
                 <li class="tab-item">
                     <a onclick="changeTab1('solutions', 'comments')">Comments ({{ nbcomments }})</a>
                 </li>
                 <li class="tab-item">
                     <a onclick="changeTab1('comments', 'solutions')">Writeups ({{ nbsolutions }})</a>
                 </li>
+                {% endif %}
             </ul>
         </div>
 
+        {% if auto_validation %}
+        <div class="column col-12" id="solves">
+            {% if solves %}
+            <table class="table table-striped">
+                <thead>
+                    <tr><th>Solver</th><th>Solved</th><th>Points</th></tr>
+                </thead>
+                <tbody>
+                {% for item in solves %}
+                    <tr>
+                        <td>
+                            {% if item.username != 'Deleted user' %}
+                            <a href="/user/{{ item.username }}">{{ item.username }}</a>
+                            {% else %}
+                            {{ item.username }}
+                            {% endif %}
+                        </td>
+                        <td>{{ item.solve.created_at|PRETTYTIME }}</td>
+                        <td>{{ item.solve.points }}</td>
+                    </tr>
+                {% endfor %}
+                </tbody>
+            </table>
+            {% else %}
+            <p>No one has solved this crackme yet.</p>
+            {% endif %}
+        </div>
+        {% else %}
         <div class="column col-12" id="comments" style="display:none">
             {% if AuthLevel == "auth" %}
             <a href="#" onclick="openModal('modal-comment'); return false;" class="btn active float-right" style="margin-top:-65px;">Post a comment</a>
@@ -279,8 +350,10 @@ <h3><a href="/user/{{ username }}">{{ username }}</a>'s {{ name }}</h3>
                 {% endfor %}
             </div>
         </div>
+        {% endif %}
     </div>
 
+    {% if not auto_validation %}
     <div class="modal" id="modal-comment">
         <a href="#" onclick="closeModal(); return false;" class="modal-overlay" aria-label="Close"></a>
         <div class="modal-container">
@@ -311,7 +384,9 @@ <h3><a href="/user/{{ username }}">{{ username }}</a>'s {{ name }}</h3>
             </div>
         </div>
     </div>
+    {% endif %}
 
+    {% if not auto_validation %}
     <div class="modal" id="rate-diff">
         <a href="#" onclick="closeModal(); return false;" class="modal-overlay" aria-label="Close"></a>
         <div class="modal-container">
@@ -338,8 +413,10 @@ <h3><a href="/user/{{ username }}">{{ username }}</a>'s {{ name }}</h3>
             </div>
         </div>
     </div>
+    {% endif %}
 </div>
 
+{% if not auto_validation or user_solve %}
 <div class="modal" id="rate-qual">
     <a href="#" onclick="closeModal(); return false;" class="modal-overlay" aria-label="Close"></a>
     <div class="modal-container">
@@ -366,9 +443,10 @@ <h3><a href="/user/{{ username }}">{{ username }}</a>'s {{ name }}</h3>
         </div>
     </div>
 </div>
+{% endif %}
 </div>
 
-{% if AuthLevel == "auth" %}
+{% if AuthLevel == "auth" and not auto_validation %}
 <div class="modal modal-lg" id="modal-labels">
     <a href="#" onclick="closeModal(); return false;" class="modal-overlay" aria-label="Close"></a>
     <div class="modal-container">
diff --git a/templates/faq/faq.html b/templates/faq/faq.html
index 515e740..5f11b86 100644
--- a/templates/faq/faq.html
+++ b/templates/faq/faq.html
@@ -100,6 +100,27 @@ <h3 id="no-information">Some crackmes do not have any information. <a href="#no-
                 class="anchor-link">#</a></h3>
         <p>Indeed, but in most cases there is a README or instructions file within the archive.</p>
         <div class="divider"></div>
+        <h3 id="submit-auto-validated-flag">How do I submit a flag? <a href="#submit-auto-validated-flag"
+                class="anchor-link">#</a></h3>
+        <p>Log in and open an active auto-validated crackme. After solving it, enter its <code>CMO{...}</code> flag in
+            the <b>Submit flag</b> section. A correct flag records the solve immediately; if it is wrong, you can try
+            again within the submission rate limit.</p>
+        <div class="divider"></div>
+        <h3 id="auto-validation-points">How do auto-validation and points work? <a href="#auto-validation-points"
+                class="anchor-link">#</a></h3>
+        <p>The site compares each submission with the reviewer-verified flag and records the attempt and result. The
+            first correct submission records a solve and awards the challenge's displayed point value, from 100 to
+            600 points. Your score and solved crackmes appear on your profile.</p>
+        <p>You cannot score on your own crackme or earn points twice for the same one. After solving an auto-validated
+            crackme, you can rate its quality.</p>
+        <div class="divider"></div>
+        <h3 id="auto-validation">How do I add a flag to my own crackme? <a href="#auto-validation" class="anchor-link">#</a></h3>
+        <p>Tick <b>Auto-validation</b> when you upload it, provide the flag and point value, and attach a ZIP with your source code and
+            build scripts. That archive is for reviewers only &mdash; it is never published or downloadable &mdash; and
+            it's how a reviewer confirms your flag is really the right one before your crackme goes live. Reviewers can
+            read your flag; nobody else can, and it is never rendered anywhere on the site. If it turns out to be wrong,
+            a reviewer can correct it.</p>
+        <div class="divider"></div>
         <h3 id="submit-writeup">How do I submit a writeup? <a href="#submit-writeup" class="anchor-link">#</a></h3>
         <p>First, you must login or register for an account. Then, navigate to the crackme page and upload your writeup
             there.</p>
@@ -387,4 +408,4 @@ <h3 id="who-runs">Who runs this site? <a href="#who-runs" class="anchor-link">#<
 </div>
 {% include 'partial/footer.html' %}
 {% endblock %}
-{% block foot %}{% endblock %}
\ No newline at end of file
+{% block foot %}{% endblock %}
diff --git a/templates/index/index.html b/templates/index/index.html
index c2ce82e..dc20c33 100644
--- a/templates/index/index.html
+++ b/templates/index/index.html
@@ -9,8 +9,8 @@ <h3>Welcome!</h3>
     <p><strong>Note:</strong> All downloads are password-protected. The password is <span style="color: #9acc14; font-weight: bold;">crackmes.one</span></p>
 
     <div class="toast" style="margin: 20px 0;">
-        <p><strong>🏆 Crackmes.one CTF 2026 - Thank You!</strong></p>
-        <p>The CTF is over, and it has been a huge success! Thank you to everyone who participated. Check out the <a href="https://ctf.crackmes.one/" target="_blank" style="color: #9acc14; font-weight: bold;">Hall of Fame</a>, read the <a href="https://blog.crackmes.one/2026/02/21/crackmes-one-ctf-2026-recap.html" target="_blank" style="color: #9acc14; font-weight: bold;">recap blog post</a>, and explore the <a href="https://github.com/crackmesone/ctf-2026-challenges-public" target="_blank" style="color: #9acc14; font-weight: bold;">challenges and writeups</a>.</p>
+        <p><strong>Auto-validated crackmes are here!</strong></p>
+        <p>Solve auto-validated crackmes to earn points. <a href="/lasts/1" style="color: #9acc14; font-weight: bold;">Try the latest crackmes</a> or <a href="/upload/crackme" style="color: #9acc14; font-weight: bold;">upload a new one</a>.</p>
     </div>
 
     <div class="columns">
diff --git a/templates/rules/crackmerules.html b/templates/rules/crackmerules.html
index 2c30448..6879512 100644
--- a/templates/rules/crackmerules.html
+++ b/templates/rules/crackmerules.html
@@ -67,6 +67,21 @@ <h3>Submission Details</h3>
             <li><b>Platform:</b> Windows, Linux, macOS, etc.</li>
         </ul>
 
+        <h3>Auto-validation (optional)</h3>
+        <p>Tick <b>Auto-validation</b> if you want solvers to prove they beat your crackme and earn points for it. Two
+            things are needed:</p>
+        <ul>
+            <li><b>The flag</b> your crackme prints when it is solved, in the format <code>CMO{...}</code> &mdash; no
+                spaces or braces inside. Reviewers can read it, because they need it to confirm your crackme is
+                solvable; it is never shown anywhere on the site.</li>
+            <li><b>A source archive</b> (zip) with your source code, build scripts and anything else needed to rebuild
+                the crackme. It is visible to <b>reviewers only</b>, never published or downloadable, and it is how a
+                reviewer confirms the flag you gave is really the right one.</li>
+        </ul>
+        <p>A reviewer assigns the crackme an official difficulty when approving it, and that fixes what a solve of it is
+            worth. Both it and the flag can be corrected later by a reviewer. Scoring is new and the exact numbers may
+            still change.</p>
+
         <h3>Difficulty Rating Guide</h3>
         <ul>
             <li><b>1 - Very Easy:</b> Plaintext strings, no obfuscation, simple comparisons</li>
diff --git a/templates/solution/editor.html b/templates/solution/editor.html
index b2b9217..0ff4c79 100644
--- a/templates/solution/editor.html
+++ b/templates/solution/editor.html
@@ -16,6 +16,8 @@ <h2>Submit a Writeup</h2>
 
     <div class="divider"></div>
 
+    <div id="upload-errors" class="toast toast-error" style="display: none;"></div>
+
     <form class="form-horizontal" method="post" id="editor-form" enctype="multipart/form-data">
         <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
         <div class="form-group">
@@ -76,7 +78,7 @@ <h2>Submit a Writeup</h2>
         {% if RECAPTCHA_SITEKEY %}
         <div class="g-recaptcha float-right" data-sitekey="{{ RECAPTCHA_SITEKEY }}" style="margin-bottom: 1rem;"></div>
         {% endif %}
-        <button type="submit" class="btn active float-right" style="{% if RECAPTCHA_SITEKEY %}margin-top: 4.5rem;{% endif %}">Submit Writeup</button>
+        <button type="submit" id="upload-submit" class="btn active float-right" style="{% if RECAPTCHA_SITEKEY %}margin-top: 4.5rem;{% endif %}">Submit Writeup</button>
     </form>
 </div>
 
@@ -95,6 +97,7 @@ <h2>Submit a Writeup</h2>
     var charCount = document.getElementById('char-count');
     var submitBtn = document.querySelector('button[type="submit"]');
     var form = document.getElementById('editor-form');
+    var errors = document.getElementById('upload-errors');
     var previewVisible = false;
 
     var minLen = {{ min_content_length }};
@@ -148,14 +151,56 @@ <h2>Submit a Writeup</h2>
     });
 
     form.addEventListener('submit', function(e) {
+        e.preventDefault();
         var hasContent = contentEl.value.trim().length > 0;
         var hasFile = fileEl.files && fileEl.files.length > 0;
         if (!hasContent && !hasFile) {
-            e.preventDefault();
-            alert('Please write a markdown writeup or attach a file (or both).');
+            showError('Please write a markdown writeup or attach a file (or both).');
+            return;
         }
+
+        errors.style.display = 'none';
+        submitBtn.disabled = true;
+        submitBtn.textContent = 'Submitting...';
+        fetch(form.action || window.location.href, {
+            method: 'POST',
+            body: new FormData(form),
+            headers: { 'X-Requested-With': 'XMLHttpRequest' },
+            credentials: 'same-origin'
+        }).then(function(response) {
+            return response.json().then(function(data) {
+                return { ok: response.ok, status: response.status, data: data };
+            }).catch(function() {
+                return { ok: response.ok, status: response.status, data: null };
+            });
+        }).then(function(result) {
+            if (result.ok && result.data && result.data.redirect) {
+                window.location = result.data.redirect;
+                return;
+            }
+            if (result.data && result.data.error) {
+                showError(result.data.error);
+            } else if (result.status === 429) {
+                showError('You have hit the daily writeup limit. Please try again later.');
+            } else {
+                showError('Submission failed (error ' + result.status + '). Please try again.');
+            }
+            submitBtn.disabled = false;
+            submitBtn.textContent = 'Submit Writeup';
+        }).catch(function() {
+            showError('Submission failed: could not reach the server. Please try again.');
+            submitBtn.disabled = false;
+            submitBtn.textContent = 'Submit Writeup';
+        });
     });
 
+    function showError(text) {
+        errors.textContent = text;
+        errors.style.display = 'block';
+        errors.scrollIntoView({ block: 'center' });
+        if (window.grecaptcha) { try { window.grecaptcha.reset(); } catch (e) {} }
+    }
+
     updateCharCount();
 })();
 </script>
diff --git a/templates/user/read.html b/templates/user/read.html
index ebb31cd..c23f11e 100644
--- a/templates/user/read.html
+++ b/templates/user/read.html
@@ -4,10 +4,13 @@
 {% block head %}{% endblock %}
 {% block content %}
 <script language="javascript" type="text/javascript">
-    function changeTab1(id1, id2, id3) {
-        document.getElementById(id3).style.display = 'none';
-        document.getElementById(id2).style.display = 'none';
-        document.getElementById(id1).style.display = 'block';
+    var PROFILE_TABS = ['crackmes', 'solutions', 'comments', 'solves'];
+
+    function changeTab1(shown) {
+        PROFILE_TABS.forEach(function(tab) {
+            var el = document.getElementById(tab);
+            if (el) el.style.display = (tab === shown) ? 'block' : 'none';
+        });
     }
 
     function revealSpoiler(id) {
@@ -37,19 +40,25 @@
 <div class="container grid-lg wrapper">
     <h3><a href="">{{ username }}</a>'s profile</h3>
     <div class="columns col-12 ">
-        <div class="column col-4">
+        <div class="column col-3">
+            <div class="column col-12 panel-background">
+                <p title="Points earned by submitting correct flags. The point system is still being tuned and may change.">Score: </p>
+                <h2 class="text-center"> {{ Score }}</h2><br>
+            </div>
+        </div>
+        <div class="column col-3">
             <div class="column col-12 panel-background">
                 <p>Number of crackmes: </p>
                 <h2 class="text-center"> {{ NbCrackmes }}</h2><br>
             </div>
         </div>
-        <div class="column col-4">
+        <div class="column col-3">
             <div class="column col-12 panel-background">
                 <p>Number of writeups: </p>
                 <h2 class="text-center"> {{ NbSolutions }}</h2><br>
             </div>
         </div>
-        <div class="column col-4">
+        <div class="column col-3">
             <div class="column col-12 panel-background">
                 <p>Comments: </p>
                 <h2 class="text-center"> {{ NbComments }}</h2><br>
@@ -57,16 +66,19 @@ <h2 class="text-center"> {{ NbComments }}</h2><br>
         </div>
     </div><br>
     <div class="container grid-lg wrapper">
-        <div class="column col-4" style="margin-bottom:20px;">
+        <div class="column col-5" style="margin-bottom:20px;">
             <ul class="tab tab-block" style="border-bottom: .05rem solid transparent;">
                 <li class="tab-item">
-                    <a onclick="changeTab1('crackmes', 'comments', 'solutions')">Crackmes</a>
+                    <a onclick="changeTab1('crackmes')">Crackmes</a>
+                </li>
+                <li class="tab-item">
+                    <a onclick="changeTab1('solutions')">Writeups</a>
                 </li>
                 <li class="tab-item">
-                    <a onclick="changeTab1('solutions', 'comments', 'crackmes')">Writeups</a>
+                    <a onclick="changeTab1('comments')">Comments</a>
                 </li>
                 <li class="tab-item">
-                    <a onclick="changeTab1('comments', 'solutions', 'crackmes')">Comments</a>
+                    <a onclick="changeTab1('solves')">Solves</a>
                 </li>
             </ul>
         </div>
@@ -140,6 +152,36 @@ <h3>Writeups</h3>
             </div>
         </div>
 
+        <div class="columns col-12" id="solves" style="display: none">
+            <h3>Solves</h3>
+            <div class="table-responsive">
+                <table class="table table-striped">
+                    <thead>
+                        <tr style="text-align: center;">
+                            <th style="width: 50%;">Crackme</th>
+                            <th style="width: 15%;">Difficulty</th>
+                            <th style="width: 15%;">Points</th>
+                            <th style="width: 20%;">Date</th>
+                        </tr>
+                    </thead>
+                    <tbody id="content-list">
+                        {% for entry in solves %}
+                        <tr class="text-center">
+                            <td><a href="/crackme/{{ entry.crackmehexid }}">{{ entry.crackmename }}</a></td>
+                            <td>{{ entry.solve.difficulty }}</td>
+                            <td>{{ entry.solve.points }}</td>
+                            <td>{{ entry.solve.created_at|PRETTYTIME }}</td>
+                        </tr>
+                        {% else %}
+                        <tr class="text-center">
+                            <td colspan="4" class="text-gray">No flags submitted yet.</td>
+                        </tr>
+                        {% endfor %}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+
         <div class="columns col-12 " id="comments" style="display: none">
             <h3>Comments</h3>
             <div class="table-responsive">
diff --git a/tests/test_comments_and_crackmes.py b/tests/test_comments_and_crackmes.py
index 61d8348..710edf3 100644
--- a/tests/test_comments_and_crackmes.py
+++ b/tests/test_comments_and_crackmes.py
@@ -75,7 +75,8 @@ def test_crackme_upload_creates_pending_record_file_and_ratings(
         'file': (BytesIO(b'not-an-archive-binary'), '../../challenge.bin'),
     }, content_type='multipart/form-data')
 
-    assert response.status_code == 200
+    assert response.status_code == 302
+    assert response.headers['Location'] == '/upload/crackme/submitted'
     crackme = db.crackme.find_one({'name': 'Uploaded Challenge'})
     assert crackme['visible'] is False
     assert crackme['original_filename'] == 'challenge.bin'
diff --git a/tests/test_labels.py b/tests/test_labels.py
index f2907e3..5e4c326 100644
--- a/tests/test_labels.py
+++ b/tests/test_labels.py
@@ -203,7 +203,7 @@ def test_upload_stores_sublabel_labels(alice_client, db, monkeypatch):
         "labels": ["Packer", "UPX", "not-real"],
         "file": (buf, "sample.zip"),
     }, content_type="multipart/form-data")
-    assert resp.status_code == 200
+    assert resp.status_code == 302
     stored = db.crackme.find_one({"name": "Labeled CM"})
     assert stored is not None
     assert stored["labels"] == ["Packer", "UPX"]  # invalid dropped, ordered
@@ -228,7 +228,7 @@ def test_upload_allows_no_labels(alice_client, db, monkeypatch):
         # no labels
         "file": (buf, "sample.zip"),
     }, content_type="multipart/form-data")
-    assert resp.status_code == 200
+    assert resp.status_code == 302
     stored = db.crackme.find_one({"name": "No Label CM"})
     assert stored is not None
     assert stored["labels"] == []
diff --git a/tests/test_onsite_writeups.py b/tests/test_onsite_writeups.py
index aefca4e..eb96e4a 100644
--- a/tests/test_onsite_writeups.py
+++ b/tests/test_onsite_writeups.py
@@ -49,6 +49,42 @@ def test_authenticated_user_can_open_writeup_editor(alice_client, sample_crackme
     assert b'Writeup (Markdown)' in response.data
     assert str(MIN_CONTENT_LENGTH).encode() in response.data
     assert f'{MAX_CONTENT_LENGTH:,}'.encode() in response.data
+    assert b"'X-Requested-With': 'XMLHttpRequest'" in response.data
+    assert b'id="upload-errors"' in response.data
+
+
+def test_background_writeup_failure_keeps_editor_state(
+        alice_client, db, sample_crackme):
+    response = alice_client.post(
+        f"/upload/solution/{sample_crackme['hexid']}",
+        data={'info': 'Still here', 'content': 'too short'},
+        content_type='multipart/form-data',
+        headers={'X-Requested-With': 'XMLHttpRequest'},
+    )
+
+    assert response.status_code == 400
+    assert response.json['ok'] is False
+    assert 'too short' in response.json['error']
+    assert db.solution.count_documents({}) == 0
+
+
+def test_background_writeup_success_uses_one_shot_confirmation(
+        alice_client, db, sample_crackme):
+    response = alice_client.post(
+        f"/upload/solution/{sample_crackme['hexid']}",
+        data={'info': 'Solved', 'content': _markdown()},
+        content_type='multipart/form-data',
+        headers={'X-Requested-With': 'XMLHttpRequest'},
+    )
+
+    assert response.status_code == 200
+    assert response.json == {
+        'ok': True, 'redirect': '/upload/solution/submitted'
+    }
+    confirmation = alice_client.get('/upload/solution/submitted')
+    assert b'Writeup' in confirmation.data
+    assert sample_crackme['name'].encode() in confirmation.data
+    assert alice_client.get('/upload/solution/submitted').status_code == 302
 
 
 def test_legacy_editor_url_redirects_to_primary_editor(alice_client, sample_crackme):
diff --git a/tests/test_remaining_utils.py b/tests/test_remaining_utils.py
index 79180bf..55710cb 100644
--- a/tests/test_remaining_utils.py
+++ b/tests/test_remaining_utils.py
@@ -23,6 +23,16 @@ def test_limiter_decorator_helpers_with_and_without_instance(monkeypatch):
     assert service.exempt(function) is function
 
 
+def test_flag_submission_limit_has_default_and_config_override(monkeypatch):
+    from app.services import limiter as service
+
+    monkeypatch.setattr(service, 'limiter_config', {})
+    assert service.configured_limit('FlagSubmissions') == '5 per minute; 20 per hour'
+    monkeypatch.setattr(service, 'limiter_config', {
+        'Limits': {'FlagSubmissions': '2 per minute; 8 per hour'}
+    })
+    assert service.configured_limit('FlagSubmissions') == '2 per minute; 8 per hour'
+
 def test_recaptcha_configuration_accessors(app):
     from app.services import recaptcha
 
diff --git a/tests/test_reviewer_remaining.py b/tests/test_reviewer_remaining.py
index 572d2e1..c395c76 100644
--- a/tests/test_reviewer_remaining.py
+++ b/tests/test_reviewer_remaining.py
@@ -1,6 +1,7 @@
 """Coverage for the remaining reviewer administration and archive workflows."""
 
 import json
+import zipfile
 from datetime import datetime, timezone
 from io import BytesIO
 
@@ -237,6 +238,31 @@ def test_site_archive_background_success_and_failure(
     assert routes.get_archive_status()['status'] == 'error'
 
 
+def test_site_archive_omits_crackme_flags(
+        db, sample_crackme, monkeypatch, tmp_path):
+    from review import routes
+
+    secret = 'CMO{must_not_leave_the_site}'
+    db.crackme.update_one(
+        {'_id': sample_crackme['_id']}, {'$set': {'flag': secret}}
+    )
+    archive_dir = _archive_paths(monkeypatch, tmp_path)
+    monkeypatch.setattr(routes, 'log_reviewer_operation', lambda *a, **k: None)
+
+    routes.create_site_archive_background('workflow-admin')
+
+    status = routes.get_archive_status()
+    with zipfile.ZipFile(archive_dir / status['filename']) as archive:
+        crackmes_name = next(
+            name for name in archive.namelist()
+            if name.endswith('/database/crackmes.json')
+        )
+        crackmes = json.loads(archive.read(crackmes_name))
+
+    assert 'flag' not in crackmes[0]
+    assert secret not in json.dumps(crackmes)
+
+
 def test_site_archive_routes_start_poll_download_and_delete(
         app, db, monkeypatch, tmp_path):
     from review import routes
diff --git a/tests/test_routes.py b/tests/test_routes.py
index f9c3468..a47ca13 100644
--- a/tests/test_routes.py
+++ b/tests/test_routes.py
@@ -9,6 +9,14 @@ def test_public_pages_load(client):
         assert client.get(path).status_code == 200, path
 
 
+def test_faq_explains_flag_submission_and_scoring(client):
+    body = client.get('/faq').get_data(as_text=True)
+
+    assert 'How do I submit a flag?' in body
+    assert 'How do auto-validation and points work?' in body
+    assert 'displayed point value, from 100 to' in body
+
+
 def test_unknown_route_is_404(client):
     assert client.get('/not-a-real-route').status_code == 404
 
diff --git a/tests/test_services_and_failures.py b/tests/test_services_and_failures.py
index def1177..f08e55c 100644
--- a/tests/test_services_and_failures.py
+++ b/tests/test_services_and_failures.py
@@ -62,6 +62,35 @@ def test_pending_discord_notifications_use_private_channel(app):
     discord.init_discord(app, {'Enabled': False})
 
 
+def test_flag_discord_notifications_use_public_and_audit_channels(app):
+    from app.services import discord
+
+    discord.init_discord(app, {
+        'Enabled': True,
+        'WebhookPublic': 'https://discord.test/public',
+        'WebhookPrivate': 'https://discord.test/private',
+    })
+    with patch.object(discord, 'send_to_webhook', return_value=True) as send:
+        assert discord.notify_flag_solved('bob', 'Challenge', 'abc', 300) is True
+        assert send.call_args.args[0].endswith('/public')
+        public_embed = send.call_args.kwargs['embed']
+        assert public_embed['title'] == 'Crackme Solved'
+        assert public_embed['fields'][0]['value'] == '[Challenge](http://localhost/crackme/abc)'
+        assert public_embed['fields'][1]['value'] == '[bob](http://localhost/user/bob)'
+
+    with patch.object(discord, 'send_private_notification', return_value=True) as send:
+        assert discord.notify_flag_submission(
+            'bob', 'Challenge', 'abc', 'CMO{attempt}', 'incorrect'
+        ) is True
+        audit_embed = send.call_args.kwargs['embed']
+        assert audit_embed['title'] == 'Flag Submitted'
+        assert audit_embed['fields'][0]['value'] == '[Challenge](http://localhost/crackme/abc)'
+        assert audit_embed['fields'][1]['value'] == '[bob](http://localhost/user/bob)'
+        assert audit_embed['fields'][2]['value'] == 'incorrect'
+        assert audit_embed['fields'][3]['value'] == 'CMO{attempt}'
+    discord.init_discord(app, {'Enabled': False})
+
+
 @pytest.mark.parametrize('error,expected', [
     (None, None),
     (RuntimeError('no documents'), 'ErrNoResult'),
diff --git a/tests/test_services_extended.py b/tests/test_services_extended.py
index 3e819d9..d8efa31 100644
--- a/tests/test_services_extended.py
+++ b/tests/test_services_extended.py
@@ -29,8 +29,10 @@ def test_archive_counts_real_files_but_ignores_metadata():
     })
 
     assert archive.get_archive_file_count(data) == 2
+    assert archive.is_zip_archive(data) is True
     assert archive.is_single_file_archive(data) is False
     assert archive.get_archive_file_count(b'not a zip') is None
+    assert archive.is_zip_archive(b'not a zip') is False
 
 
 def test_single_file_zip_is_detected():
diff --git a/tests/test_solves.py b/tests/test_solves.py
new file mode 100644
index 0000000..60faeae
--- /dev/null
+++ b/tests/test_solves.py
@@ -0,0 +1,980 @@
+"""Flag submission, solve records and the points they award."""
+
+import zipfile
+from io import BytesIO
+
+import pytest
+
+from app.services.flag import flags_match, is_valid_flag_format, normalize_flag
+from app.services.points import points_for_solve, solve_difficulty
+
+FLAG = 'CMO{a_perfectly_good_flag}'
+
+
+def _hexid(user):
+    """The immutable id solves are keyed by."""
+    return user.get('hexid') or str(user['_id'])
+
+
+def _zip_bytes():
+    """A two-file zip, which is what the archive checks accept."""
+    buf = BytesIO()
+    with zipfile.ZipFile(buf, 'w') as archive:
+        archive.writestr('main.c', 'int main(void){return 0;}')
+        archive.writestr('Makefile', 'all:\n\tcc main.c')
+    buf.seek(0)
+    return buf
+
+
+@pytest.fixture
+def flagged_crackme(db, sample_crackme):
+    """Alice's crackme, opted into auto-validation at difficulty 3."""
+    db.crackme.update_one(
+        {'_id': sample_crackme['_id']},
+        {'$set': {
+            'flag': FLAG,
+            'source_original_filename': 'source.zip',
+            'official_difficulty': 3,
+        }}
+    )
+    return db.crackme.find_one({'_id': sample_crackme['_id']})
+
+
+# ---------------------------------------------------------------- flag format
+
+@pytest.mark.parametrize('flag', [
+    'CMO{ok}',
+    'CMO{' + 'x' * 56 + '}',
+])
+def test_valid_flags_are_accepted(flag):
+    assert is_valid_flag_format(flag)
+
+
+@pytest.mark.parametrize('flag', [
+    '',
+    'ok',
+    'CTF{ok}',
+    'CMO{}',
+    'CMO{nested{braces}}',
+    'CMO{has space}',
+    'CMO{' + 'x' * 57 + '}',        # longer than the body limit
+    'prefix CMO{ok}',
+    'CMO{\u00fcnicode}',            # ASCII only, so a flag's bytes stay bounded
+    'CMO{tab\tinside}',
+])
+def test_invalid_flags_are_rejected(flag):
+    assert not is_valid_flag_format(flag)
+
+
+def test_surrounding_whitespace_is_not_a_wrong_answer():
+    assert normalize_flag(f'  {FLAG}\n') == FLAG
+
+
+def test_flags_match_only_the_exact_flag():
+    assert flags_match(FLAG, FLAG)
+    assert not flags_match(FLAG, 'CMO{wrong}')
+    assert not flags_match(FLAG, FLAG.upper())
+    assert not flags_match(None, FLAG)
+    assert not flags_match(FLAG, '')
+
+
+# -------------------------------------------------------------------- scoring
+
+def test_official_difficulty_prices_a_solve():
+    crackme = {'official_difficulty': 4, 'difficulty': 1.2}
+
+    assert solve_difficulty(crackme) == 4
+    assert points_for_solve(crackme) == 400
+
+
+def test_fractional_official_difficulty_supports_author_selected_points():
+    crackme = {'official_difficulty': 3.57, 'difficulty': 1.2}
+
+    assert solve_difficulty(crackme) == 3.57
+    assert points_for_solve(crackme) == 357
+
+
+def test_scoring_falls_back_to_the_community_rating_when_unofficial():
+    # Crackmes approved before reviewers assigned difficulties have none.
+    assert points_for_solve({'difficulty': 2.6}) == 300
+    assert points_for_solve({'official_difficulty': None, 'difficulty': 0}) == 100
+    assert points_for_solve({'difficulty': 99}) == 600
+
+
+# --------------------------------------------------------------------- upload
+
+def _upload(client, monkeypatch, tmp_path, **extra):
+    from app.controllers import crackme as crackme_controller
+
+    monkeypatch.setattr(crackme_controller, 'UPLOAD_FOLDER', str(tmp_path / 'pending'))
+    monkeypatch.setattr(crackme_controller, 'SOURCE_UPLOAD_FOLDER', str(tmp_path / 'source'))
+    data = {
+        'name': 'Flagged Challenge',
+        'info': 'Find the flag.',
+        'lang': 'C/C++',
+        'difficulty': '3',
+        'platform': 'Linux',
+        'arch': 'x86-64',
+        'file': (BytesIO(b'challenge-binary'), 'challenge.bin'),
+    }
+    data.update(extra)
+    return client.post('/upload/crackme', data=data,
+                       content_type='multipart/form-data',
+                       follow_redirects=True)
+
+
+def test_opting_into_auto_validation_stores_flag_hash_and_private_source(
+        alice_client, db, alice, tmp_path, monkeypatch):
+    response = _upload(alice_client, monkeypatch, tmp_path,
+                       auto_validation='on', flag=FLAG, points='357',
+                       source=(_zip_bytes(), 'source.zip'))
+
+    assert response.status_code == 200
+    assert b'has been submitted' in response.data or b'Flagged Challenge' in response.data
+    crackme = db.crackme.find_one({'name': 'Flagged Challenge'})
+    assert crackme['flag'] == FLAG
+    assert crackme['source_original_filename'] == 'source.zip'
+    assert crackme['official_difficulty'] == 3.57
+    # The source archive lands outside static/, where nothing serves it.
+    assert (tmp_path / 'source' / crackme['hexid']).exists()
+
+
+def test_upload_without_opting_in_stores_no_flag(
+        alice_client, db, alice, tmp_path, monkeypatch):
+    response = _upload(alice_client, monkeypatch, tmp_path)
+
+    assert response.status_code == 200
+    assert db.crackme.find_one({'name': 'Flagged Challenge'})['flag'] is None
+
+
+def test_auto_validation_requires_a_well_formed_flag_and_a_source_archive(
+        alice_client, db, alice, tmp_path, monkeypatch):
+    bad_flag = _upload(alice_client, monkeypatch, tmp_path,
+                       auto_validation='on', flag='not-a-flag',
+                       source=(_zip_bytes(), 'source.zip'))
+    no_source = _upload(alice_client, monkeypatch, tmp_path,
+                        auto_validation='on', flag=FLAG)
+
+    assert b'Invalid flag format' in bad_flag.data
+    assert b'needs a source archive' in no_source.data
+    assert db.crackme.count_documents({}) == 0
+
+
+def test_auto_validation_requires_the_verification_file_to_be_a_zip(
+        alice_client, db, alice, tmp_path, monkeypatch):
+    response = _upload(
+        alice_client, monkeypatch, tmp_path,
+        auto_validation='on', flag=FLAG,
+        source=(BytesIO(b'# plain text writeup'), 'writeup.txt'),
+    )
+
+    assert b'must be a valid ZIP archive' in response.data
+    assert db.crackme.count_documents({}) == 0
+
+
+@pytest.mark.parametrize('points', ['99', '601', '250.5', 'many'])
+def test_auto_validation_rejects_invalid_points(
+        alice_client, db, alice, tmp_path, monkeypatch, points):
+    response = _upload(
+        alice_client, monkeypatch, tmp_path,
+        auto_validation='on', flag=FLAG, points=points,
+        source=(_zip_bytes(), 'source.zip'),
+    )
+
+    assert b'Points must be a whole number from 100 to 600' in response.data
+    assert db.crackme.count_documents({}) == 0
+
+
+def test_auto_validation_points_default_to_selected_difficulty(
+        alice_client, db, alice, tmp_path, monkeypatch):
+    response = _upload(
+        alice_client, monkeypatch, tmp_path,
+        difficulty='4', auto_validation='on', flag=FLAG,
+        source=(_zip_bytes(), 'source.zip'),
+    )
+
+    assert response.status_code == 200
+    assert db.crackme.find_one({'name': 'Flagged Challenge'})[
+        'official_difficulty'
+    ] == 4.0
+
+
+# ---------------------------------------------------------------- solve flow
+
+def test_correct_flag_records_a_solve_and_awards_points(
+        bob_client, db, bob, flagged_crackme, monkeypatch):
+    from app.controllers import crackme as crackme_controller
+    audit_notifications = []
+    solve_notifications = []
+    monkeypatch.setattr(
+        crackme_controller, 'notify_flag_submission',
+        lambda *args: audit_notifications.append(args),
+    )
+    monkeypatch.setattr(
+        crackme_controller, 'notify_flag_solved',
+        lambda *args: solve_notifications.append(args),
+    )
+    response = bob_client.post(f"/crackme/{flagged_crackme['hexid']}/solve",
+                               data={'flag': f'  {FLAG} '},
+                               follow_redirects=True)
+
+    assert response.status_code == 200
+    solve = db.solve.find_one({'user_hexid': _hexid(bob)})
+    assert solve['crackme_hexid'] == flagged_crackme['hexid']
+    assert solve['points'] == 300
+    assert solve['difficulty'] == 3
+    assert db.notifications.count_documents({'user': 'bob'}) == 1
+    submission = db.flag_submission.find_one({})
+    assert submission['user_hexid'] == _hexid(bob)
+    assert submission['username'] == 'bob'
+    assert submission['crackme_hexid'] == flagged_crackme['hexid']
+    assert submission['submitted_flag'] == FLAG
+    assert submission['result'] == 'correct'
+    assert audit_notifications == [(
+        'bob', flagged_crackme['name'], flagged_crackme['hexid'], FLAG, 'correct'
+    )]
+    assert solve_notifications == [(
+        'bob', flagged_crackme['name'], flagged_crackme['hexid'], 300
+    )]
+
+
+def test_solve_snapshots_fractional_difficulty(
+        bob_client, db, bob, flagged_crackme):
+    db.crackme.update_one(
+        {'_id': flagged_crackme['_id']},
+        {'$set': {'official_difficulty': 3.57}},
+    )
+
+    bob_client.post(
+        f"/crackme/{flagged_crackme['hexid']}/solve", data={'flag': FLAG}
+    )
+
+    solve = db.solve.find_one({'user_hexid': _hexid(bob)})
+    assert solve['points'] == 357
+    assert solve['difficulty'] == 3.57
+
+
+def test_wrong_flag_records_nothing(
+        bob_client, db, bob, flagged_crackme, monkeypatch):
+    from app.controllers import crackme as crackme_controller
+    audit_notifications = []
+    solve_notifications = []
+    monkeypatch.setattr(
+        crackme_controller, 'notify_flag_submission',
+        lambda *args: audit_notifications.append(args),
+    )
+    monkeypatch.setattr(
+        crackme_controller, 'notify_flag_solved',
+        lambda *args: solve_notifications.append(args),
+    )
+    response = bob_client.post(f"/crackme/{flagged_crackme['hexid']}/solve",
+                               data={'flag': 'CMO{nope}'},
+                               follow_redirects=True)
+
+    assert b'Wrong flag' in response.data
+    assert db.solve.count_documents({}) == 0
+    submission = db.flag_submission.find_one({})
+    assert submission['submitted_flag'] == 'CMO{nope}'
+    assert submission['result'] == 'incorrect'
+    assert audit_notifications == [(
+        'bob', flagged_crackme['name'], flagged_crackme['hexid'],
+        'CMO{nope}', 'incorrect'
+    )]
+    assert solve_notifications == []
+
+
+def test_resubmitting_a_correct_flag_does_not_award_twice(
+        bob_client, db, bob, flagged_crackme):
+    path = f"/crackme/{flagged_crackme['hexid']}/solve"
+    bob_client.post(path, data={'flag': FLAG})
+    again = bob_client.post(path, data={'flag': FLAG}, follow_redirects=True)
+
+    assert b'already solved' in again.data
+    assert db.solve.count_documents({'user_hexid': _hexid(bob)}) == 1
+    assert [entry['result'] for entry in db.flag_submission.find({})] == [
+        'correct', 'already_solved'
+    ]
+
+
+def test_author_cannot_solve_their_own_crackme(
+        alice_client, db, alice, flagged_crackme):
+    response = alice_client.post(f"/crackme/{flagged_crackme['hexid']}/solve",
+                                 data={'flag': FLAG}, follow_redirects=True)
+
+    assert b"your own crackme" in response.data
+    assert db.solve.count_documents({}) == 0
+    assert db.flag_submission.find_one({})['result'] == 'own_crackme'
+
+
+def test_crackme_without_auto_validation_accepts_no_flags(
+        bob_client, db, bob, sample_crackme):
+    response = bob_client.post(f"/crackme/{sample_crackme['hexid']}/solve",
+                               data={'flag': FLAG}, follow_redirects=True)
+
+    assert b'does not accept flag submissions' in response.data
+    assert db.solve.count_documents({}) == 0
+    assert db.flag_submission.find_one({})['result'] == 'not_enabled'
+
+
+def test_malformed_flag_submission_is_logged_with_the_submitted_value(
+        bob_client, db, bob, flagged_crackme):
+    response = bob_client.post(f"/crackme/{flagged_crackme['hexid']}/solve",
+                               data={'flag': 'not a flag'},
+                               follow_redirects=True)
+
+    assert b'not a valid flag' in response.data
+    submission = db.flag_submission.find_one({})
+    assert submission['result'] == 'invalid_format'
+    assert submission['user_hexid'] == _hexid(bob)
+    assert submission['submitted_flag'] == 'not a flag'
+
+
+def test_anonymous_visitors_cannot_submit_flags(client, db, flagged_crackme):
+    response = client.post(f"/crackme/{flagged_crackme['hexid']}/solve",
+                           data={'flag': FLAG})
+
+    assert response.status_code == 302
+    assert response.headers['Location'] == '/'
+    assert db.solve.count_documents({}) == 0
+
+
+# ------------------------------------------------------------------ rendering
+
+def test_crackme_page_shows_the_flag_form_and_then_the_solved_state(
+        bob_client, db, bob, flagged_crackme):
+    path = f"/crackme/{flagged_crackme['hexid']}"
+
+    before = bob_client.get(path)
+    assert b'Submit flag' in before.data
+    assert b'Solves:<br> 0' in before.data
+    assert b'Attempts:<br> 0' in before.data
+    assert b'Solves (0)' in before.data
+    assert b'Points:<br> 300' in before.data
+    assert b'Difficulty:<br>' not in before.data
+    assert b'This crackme is auto-validated' not in before.data
+    assert b'Comments (' not in before.data
+    assert b'Writeups (' not in before.data
+    assert b'Post a comment' not in before.data
+    assert b'Submit a writeup' not in before.data
+    assert b'<b>Labels</b>' not in before.data
+    assert b'Request a label change' not in before.data
+    assert b'id="rate-diff"' not in before.data
+    assert b"openModal('rate-diff')" not in before.data
+    assert b"openModal('rate-qual')" not in before.data
+
+    bob_client.post(f'{path}/solve', data={'flag': 'CMO{wrong}'})
+    bob_client.post(f'{path}/solve', data={'flag': FLAG})
+    after = bob_client.get(path)
+
+    assert b'Solved!' in after.data
+    assert b'Submit flag' not in after.data
+    assert b'Solves:<br> 1' in after.data
+    assert b'Attempts:<br> 2' in after.data
+    assert b'Solves (1)' in after.data
+    assert b'>bob</a>' in after.data
+    assert b"openModal('rate-qual')" in after.data
+
+
+def test_auto_validated_crackme_rejects_comments_and_writeups_in_backend(
+        bob_client, db, flagged_crackme):
+    hexid = flagged_crackme['hexid']
+
+    comment = bob_client.post(
+        f'/comment/{hexid}', data={'comment': 'Backend bypass attempt'},
+        follow_redirects=True
+    )
+    writeup_form = bob_client.get(
+        f'/upload/solution/{hexid}', follow_redirects=True
+    )
+    writeup_post = bob_client.post(
+        f'/upload/solution/{hexid}',
+        data={'info': 'Bypass', 'content': 'A' * 300},
+        follow_redirects=True
+    )
+
+    assert b'Comments are disabled for auto-validated crackmes' in comment.data
+    assert b'Writeups are disabled for auto-validated crackmes' in writeup_form.data
+    assert b'Writeups are disabled for auto-validated crackmes' in writeup_post.data
+    assert db.comment.count_documents({}) == 0
+    assert db.solution.count_documents({}) == 0
+
+
+def test_auto_validated_crackme_rejects_difficulty_ratings_in_backend(
+        bob_client, db, flagged_crackme):
+    response = bob_client.post(
+        f"/crackme/rate-diff/{flagged_crackme['hexid']}",
+        data={'difficulty': '6'},
+        follow_redirects=True
+    )
+
+    assert b'Difficulty ratings are disabled for auto-validated crackmes' in response.data
+    assert db.rating_difficulty.count_documents({}) == 0
+
+
+def test_auto_validated_crackme_allows_quality_rating_only_after_solve(
+        bob_client, db, bob, flagged_crackme):
+    path = f"/crackme/rate-qual/{flagged_crackme['hexid']}"
+
+    before = bob_client.post(
+        path, data={'quality': '6'}, follow_redirects=True
+    )
+    assert b'Solve this crackme before rating it' in before.data
+    assert db.rating_quality.count_documents({}) == 0
+
+    bob_client.post(
+        f"/crackme/{flagged_crackme['hexid']}/solve", data={'flag': FLAG}
+    )
+    after = bob_client.post(
+        path, data={'quality': '6'}, follow_redirects=True
+    )
+
+    assert b'Rated!' in after.data
+    assert db.rating_quality.find_one({
+        'author': 'bob', 'crackmehexid': flagged_crackme['hexid']
+    })['rating'] == 6
+
+
+def test_crackme_page_has_no_flag_section_without_auto_validation(
+        bob_client, db, sample_crackme):
+    response = bob_client.get(f"/crackme/{sample_crackme['hexid']}")
+
+    assert b'Submit flag' not in response.data
+    assert b'<b>Labels</b>' in response.data
+
+
+def test_profile_shows_score_and_solved_crackmes(
+        bob_client, client, db, bob, flagged_crackme):
+    bob_client.post(f"/crackme/{flagged_crackme['hexid']}/solve", data={'flag': FLAG})
+
+    profile = client.get('/user/bob')
+
+    assert profile.status_code == 200
+    assert b'Score:' in profile.data
+    assert b'>Solves<' in profile.data
+    assert flagged_crackme['name'].encode() in profile.data
+
+
+def test_profile_of_a_user_without_solves_scores_zero(client, db, alice):
+    profile = client.get('/user/alice')
+
+    assert profile.status_code == 200
+    assert b'No flags submitted yet.' in profile.data
+
+
+# ------------------------------------------------------------ reviewer tools
+
+def _review_dirs(monkeypatch, tmp_path):
+    """Point the reviewer file helpers at throwaway directories."""
+    from review import routes
+
+    pending = tmp_path / 'pending'
+    approved = tmp_path / 'approved'
+    source = tmp_path / 'source'
+    for path in (pending / 'crackme', pending / 'solution',
+                 approved / 'crackme', approved / 'solution', source):
+        path.mkdir(parents=True)
+
+    monkeypatch.setattr(routes, 'get_tmp_dir', lambda item_type: str(pending / item_type))
+    monkeypatch.setattr(routes, 'get_static_dir', lambda item_type: str(approved / item_type))
+    monkeypatch.setattr(routes, 'get_source_dir', lambda: str(source))
+    return pending, approved, source
+
+
+def _approval_data(crackme, **overrides):
+    data = {
+        'uuid': crackme['hexid'],
+        'csrf_token': 'test-csrf-token',
+        'info': crackme['info'],
+        'lang': crackme['lang'],
+        'arch': crackme['arch'],
+        'platform': crackme['platform'],
+        'flag': crackme.get('flag') or '',
+        'official_points': str(round(
+            (crackme.get('official_difficulty') or 3) * 100
+        )),
+        'labels': crackme.get('labels', []),
+    }
+    data.update(overrides)
+    return data
+
+
+def test_reviewer_downloads_the_private_source_archive(
+        reviewer_client, db, flagged_crackme, monkeypatch, tmp_path):
+    _, _, source = _review_dirs(monkeypatch, tmp_path)
+    (source / flagged_crackme['hexid']).write_bytes(b'source-archive')
+
+    response = reviewer_client.get(
+        f"/review/downloadreview?type=source&uuid={flagged_crackme['hexid']}"
+    )
+
+    assert response.status_code == 200
+    assert response.data == b'source-archive'
+    assert 'source.zip' in response.headers['Content-Disposition']
+
+
+def test_approval_records_the_official_difficulty(
+        reviewer_client, db, flagged_crackme, monkeypatch, tmp_path):
+    from review import routes
+
+    pending, _, _ = _review_dirs(monkeypatch, tmp_path)
+    db.crackme.update_one({'_id': flagged_crackme['_id']},
+                          {'$set': {'visible': False, 'official_difficulty': None}})
+    (pending / 'crackme' / flagged_crackme['hexid']).write_bytes(b'binary')
+    monkeypatch.setattr(routes, 'create_password_protected_zip', lambda *a: (True, None))
+    monkeypatch.setattr(routes, 'notify_crackme_approved', lambda *a: None)
+    monkeypatch.setattr(routes, 'log_reviewer_operation', lambda *a, **kw: None)
+
+    response = reviewer_client.post(
+        '/review/approvecrackme',
+        data=_approval_data(
+            flagged_crackme, official_points='357', info='Reviewer corrected',
+            lang='Rust', arch='ARM', platform='Windows',
+            flag='CMO{reviewer_corrected}',
+        ),
+    )
+
+    assert response.status_code == 302
+    stored = db.crackme.find_one({'_id': flagged_crackme['_id']})
+    assert stored['visible'] is True
+    assert stored['official_difficulty'] == 3.57
+    assert stored['info'] == 'Reviewer corrected'
+    assert stored['lang'] == 'Rust'
+    assert stored['arch'] == 'ARM'
+    assert stored['platform'] == 'Windows'
+    assert stored['flag'] == 'CMO{reviewer_corrected}'
+
+
+@pytest.mark.parametrize('points', ['99', '601', '250.5', 'many'])
+def test_review_approval_rejects_invalid_points(
+        reviewer_client, db, flagged_crackme, monkeypatch, tmp_path, points):
+    from review import routes
+
+    pending, _, _ = _review_dirs(monkeypatch, tmp_path)
+    db.crackme.update_one({'_id': flagged_crackme['_id']},
+                          {'$set': {'visible': False}})
+    (pending / 'crackme' / flagged_crackme['hexid']).write_bytes(b'binary')
+    monkeypatch.setattr(routes, 'log_reviewer_operation', lambda *a, **kw: None)
+
+    response = reviewer_client.post(
+        '/review/approvecrackme',
+        data=_approval_data(flagged_crackme, official_points=points),
+        follow_redirects=True,
+    )
+
+    assert b'Points must be a whole number from 100 to 600' in response.data
+    assert db.crackme.find_one({'_id': flagged_crackme['_id']})['visible'] is False
+
+
+def test_rejecting_a_crackme_removes_its_private_source(
+        reviewer_client, db, flagged_crackme, monkeypatch, tmp_path):
+    from review import routes
+
+    pending, _, source = _review_dirs(monkeypatch, tmp_path)
+    db.crackme.update_one({'_id': flagged_crackme['_id']}, {'$set': {'visible': False}})
+    (pending / 'crackme' / flagged_crackme['hexid']).write_bytes(b'binary')
+    archive = source / flagged_crackme['hexid']
+    archive.write_bytes(b'source-archive')
+    monkeypatch.setattr(routes, 'log_reviewer_operation', lambda *a, **kw: None)
+
+    reviewer_client.post('/review/rejectcrackme', data={
+        'uuid': flagged_crackme['hexid'], 'reject_reason': 'nope',
+        'csrf_token': 'test-csrf-token',
+    })
+
+    assert archive.exists() is False
+    assert db.crackme.count_documents({}) == 0
+
+
+def test_deleting_a_crackme_takes_its_solves_and_source_with_it(
+        db, bob, flagged_crackme, monkeypatch, tmp_path):
+    from review import routes
+
+    _, approved, source = _review_dirs(monkeypatch, tmp_path)
+    (approved / 'crackme' / f"{flagged_crackme['hexid']}.zip").write_bytes(b'zip')
+    archive = source / flagged_crackme['hexid']
+    archive.write_bytes(b'source-archive')
+    db.solve.insert_one({
+        'user_hexid': _hexid(bob),
+        'crackme_hexid': flagged_crackme['hexid'],
+        'points': 300,
+    })
+    db.flag_submission.insert_one({
+        'user_hexid': _hexid(bob),
+        'username': 'bob',
+        'crackme_hexid': flagged_crackme['hexid'],
+        'result': 'correct',
+    })
+
+    message = routes.delete_approved_crackme(flagged_crackme['hexid'])
+
+    assert '1 solves' in message
+    assert db.solve.count_documents({}) == 0
+    assert db.flag_submission.count_documents({}) == 0
+    assert archive.exists() is False
+
+
+def test_deleting_a_user_removes_their_solves(db, bob, flagged_crackme, monkeypatch):
+    from review import routes
+
+    monkeypatch.setattr(routes, 'log_reviewer_operation', lambda *a, **kw: None)
+    db.solve.insert_one({
+        'user_hexid': _hexid(bob),
+        'crackme_hexid': flagged_crackme['hexid'],
+        'points': 300,
+    })
+    db.flag_submission.insert_one({
+        'user_hexid': _hexid(bob),
+        'username': 'bob',
+        'crackme_hexid': flagged_crackme['hexid'],
+        'result': 'incorrect',
+    })
+
+    preview, error = routes.preview_user_deletion(bob['email'])
+    assert error is None
+    assert preview['solves'] == 1
+    assert preview['flag_submissions'] == 1
+
+    routes.delete_user_account(bob['email'])
+
+    assert db.solve.count_documents({}) == 0
+    assert db.flag_submission.count_documents({}) == 0
+
+
+def test_review_page_offers_the_flag_tools_for_an_opted_in_crackme(
+        reviewer_client, db, flagged_crackme):
+    db.flag_submission.insert_one({
+        'username': 'bob',
+        'crackme_hexid': flagged_crackme['hexid'],
+        'submitted_flag': 'CMO{reviewed_attempt}',
+        'result': 'incorrect',
+    })
+    response = reviewer_client.get(
+        f"/review/viewcrackme?crackme_uuid={flagged_crackme['hexid']}"
+    )
+
+    assert response.status_code == 200
+    assert b'Download private verification ZIP' in response.data
+    assert b'name="official_points"' in response.data
+    assert b'min="100" max="600" step="1"' in response.data
+    # Reviewers need to see the flag to confirm the crackme is really solvable.
+    assert FLAG.encode() in response.data
+    assert b'Recent flag submissions' not in response.data
+    assert b'CMO{reviewed_attempt}' not in response.data
+    assert b'id="change-status"' in response.data
+    assert b'id="discard-changes"' in response.data
+    assert b'name="lang"' in response.data
+    assert b'name="arch"' in response.data
+    assert b'name="platform"' in response.data
+    assert b'name="info"' in response.data
+
+
+def test_review_page_says_so_when_a_crackme_is_not_auto_validated(
+        reviewer_client, db, sample_crackme):
+    response = reviewer_client.get(
+        f"/review/viewcrackme?crackme_uuid={sample_crackme['hexid']}"
+    )
+
+    assert response.status_code == 200
+    assert b'did not enable auto-validation' in response.data
+
+
+def test_regular_reviewer_cannot_see_flag_validation_history(
+        reviewer_client, db, flagged_crackme):
+    db.flag_submission.insert_one({
+        'username': 'bob',
+        'crackme_hexid': flagged_crackme['hexid'],
+        'submitted_flag': 'CMO{dashboard_attempt}',
+        'result': 'incorrect',
+    })
+
+    response = reviewer_client.get('/review/dashboard')
+
+    assert response.status_code == 200
+    assert b'Review flag validations' not in response.data
+    assert b'CMO{dashboard_attempt}' not in response.data
+    assert reviewer_client.get('/review/flagvalidations').status_code == 403
+
+
+def test_admin_opens_flag_validations_from_dashboard(
+        admin_client, db, flagged_crackme):
+    db.flag_submission.insert_one({
+        'username': 'bob',
+        'crackme_hexid': flagged_crackme['hexid'],
+        'submitted_flag': 'CMO{admin_review_attempt}',
+        'result': 'incorrect',
+    })
+
+    dashboard = admin_client.get('/review/dashboard')
+    page = admin_client.get('/review/flagvalidations')
+
+    assert dashboard.status_code == 200
+    assert b'Review flag validations' in dashboard.data
+    assert b'CMO{admin_review_attempt}' not in dashboard.data
+    assert page.status_code == 200
+    assert flagged_crackme['name'].encode() in page.data
+    assert b'CMO{admin_review_attempt}' in page.data
+    assert b'Incorrect' in page.data
+
+
+def test_public_pages_never_render_the_flag(client, bob_client, db, flagged_crackme):
+    # The flag is stored in cleartext for reviewers, so the public views must
+    # keep rendering a fixed set of fields that doesn't include it.
+    pages = [
+        client.get(f"/crackme/{flagged_crackme['hexid']}"),
+        bob_client.get(f"/crackme/{flagged_crackme['hexid']}"),
+        client.get('/lasts/1'),
+        client.get('/user/alice'),
+        client.get('/search?name=Test'),
+        client.get('/rss'),
+    ]
+
+    for page in pages:
+        assert FLAG.encode() not in page.data
+
+
+def _admin_client(app):
+    from review import routes
+    from review.routes import (
+        REVIEWER_ADMIN_KEY, REVIEWER_CSRF_KEY, REVIEWER_SESSION_KEY
+    )
+
+    routes.users['admin'] = {'password_hash': 'x', 'is_admin': True}
+    client = app.test_client()
+    with client.session_transaction() as session:
+        session[REVIEWER_SESSION_KEY] = 'admin'
+        session[REVIEWER_ADMIN_KEY] = True
+        session[REVIEWER_CSRF_KEY] = 'test-csrf-token'
+    return client
+
+
+@pytest.fixture
+def admin_client(app):
+    from review import routes
+
+    client = _admin_client(app)
+    yield client
+    routes.users.pop('admin', None)
+
+
+def _edit(client, crackme, **overrides):
+    data = {
+        'crackme_uuid': crackme['hexid'],
+        'csrf_token': 'test-csrf-token',
+        'info': crackme.get('info', ''),
+        'lang': crackme.get('lang', ''),
+        'arch': crackme.get('arch', ''),
+        'platform': crackme.get('platform', ''),
+        'flag': crackme.get('flag') or '',
+        'official_points': str(round((crackme.get('official_difficulty') or 0) * 100) or ''),
+    }
+    data.update(overrides)
+    return client.post('/review/editcrackme', data=data,
+                       content_type='multipart/form-data')
+
+
+def test_admin_edits_every_crackme_field_including_flag_and_difficulty(
+        admin_client, db, flagged_crackme, monkeypatch):
+    from review import routes
+
+    logged = []
+    monkeypatch.setattr(routes, 'log_reviewer_operation',
+                        lambda op, who, details, ok: logged.append(details))
+
+    response = _edit(admin_client, flagged_crackme,
+                     info='Rewritten description', lang='Rust', arch='ARM',
+                     platform='Windows', flag='CMO{corrected}',
+                     official_points='600', notify_author='on')
+
+    assert response.status_code == 200
+    stored = db.crackme.find_one({'_id': flagged_crackme['_id']})
+    assert stored['info'] == 'Rewritten description'
+    assert stored['lang'] == 'Rust'
+    assert stored['arch'] == 'ARM'
+    assert stored['platform'] == 'Windows'
+    assert stored['flag'] == 'CMO{corrected}'
+    assert stored['official_difficulty'] == 6
+    # The flag change is recorded, but neither the log nor the author's
+    # notification quotes the flag itself.
+    assert 'flag changed' in logged[0]['changes']
+    assert 'CMO{corrected}' not in str(logged[0])
+    assert 'CMO{corrected}' not in db.notifications.find_one({'user': 'alice'})['text']
+
+
+def test_a_corrected_flag_is_the_one_that_now_scores(
+        admin_client, bob_client, db, bob, flagged_crackme, monkeypatch):
+    from review import routes
+
+    monkeypatch.setattr(routes, 'log_reviewer_operation', lambda *a, **kw: None)
+    _edit(admin_client, flagged_crackme, flag='CMO{corrected}', official_points='600')
+    path = f"/crackme/{flagged_crackme['hexid']}/solve"
+
+    stale = bob_client.post(path, data={'flag': FLAG}, follow_redirects=True)
+    corrected = bob_client.post(path, data={'flag': 'CMO{corrected}'},
+                                follow_redirects=True)
+
+    assert b'Wrong flag' in stale.data
+    assert b'Correct!' in corrected.data
+    assert db.solve.find_one({'user_hexid': _hexid(bob)})['points'] == 600
+
+
+def test_admin_turns_auto_validation_off_without_erasing_earned_points(
+        admin_client, db, bob, flagged_crackme, monkeypatch):
+    from review import routes
+
+    monkeypatch.setattr(routes, 'log_reviewer_operation', lambda *a, **kw: None)
+    db.solve.insert_one({
+        'user_hexid': _hexid(bob), 'crackme_hexid': flagged_crackme['hexid'],
+        'points': 300, 'difficulty': 3,
+    })
+
+    _edit(admin_client, flagged_crackme, remove_flag='on')
+
+    assert db.crackme.find_one({'_id': flagged_crackme['_id']})['flag'] is None
+    assert db.solve.count_documents({}) == 1
+
+
+def test_admin_edit_rejects_a_malformed_flag_or_difficulty(
+        admin_client, db, flagged_crackme, monkeypatch):
+    from review import routes
+
+    monkeypatch.setattr(routes, 'log_reviewer_operation', lambda *a, **kw: None)
+
+    bad_flag = _edit(admin_client, flagged_crackme, flag='nope')
+    bad_difficulty = _edit(admin_client, flagged_crackme, official_points='601')
+
+    assert b'Invalid flag format' in bad_flag.data
+    assert b'Points must be a whole number from 100 to 600' in bad_difficulty.data
+    stored = db.crackme.find_one({'_id': flagged_crackme['_id']})
+    assert stored['flag'] == FLAG
+    assert stored['official_difficulty'] == 3
+
+
+def test_admin_replaces_the_private_source_archive(
+        admin_client, db, flagged_crackme, monkeypatch, tmp_path):
+    from review import routes
+
+    _, _, source = _review_dirs(monkeypatch, tmp_path)
+    monkeypatch.setattr(routes, 'log_reviewer_operation', lambda *a, **kw: None)
+
+    _edit(admin_client, flagged_crackme,
+          source_file=(_zip_bytes(), 'rebuilt-source.zip'))
+
+    stored = db.crackme.find_one({'_id': flagged_crackme['_id']})
+    assert stored['source_original_filename'] == 'rebuilt-source.zip'
+    assert (source / flagged_crackme['hexid']).exists()
+
+
+def test_admin_edit_page_shows_the_flag_and_difficulty_fields(
+        admin_client, db, flagged_crackme):
+    response = admin_client.get(
+        f"/review/editcrackme?crackme_uuid={flagged_crackme['hexid']}"
+    )
+
+    assert response.status_code == 200
+    assert FLAG.encode() in response.data
+    assert b'name="official_points"' in response.data
+    assert b'min="100" max="600" step="1"' in response.data
+    assert b'Private source archive' in response.data
+
+
+def test_non_admin_reviewers_cannot_reach_the_editor(reviewer_client, flagged_crackme):
+    response = reviewer_client.get(
+        f"/review/editcrackme?crackme_uuid={flagged_crackme['hexid']}"
+    )
+
+    assert response.status_code == 403
+
+
+# ------------------------------------------------- upload failure recovery
+
+def test_a_rejected_upload_keeps_what_the_user_typed(
+        alice_client, db, alice, tmp_path, monkeypatch):
+    from app.controllers import crackme as crackme_controller
+
+    monkeypatch.setattr(crackme_controller, 'UPLOAD_FOLDER', str(tmp_path / 'pending'))
+    response = alice_client.post('/upload/crackme', data={
+        'name': 'Half Filled Challenge',
+        'info': 'A long description nobody wants to retype.',
+        'lang': 'Rust',
+        'difficulty': '5',
+        'platform': 'Windows',
+        'arch': 'ARM',
+        'labels': ['Packer'],
+        'auto_validation': 'on',
+        'flag': 'CMO{typed_but_not_lost}',
+        # ... and no file, so the submission is rejected.
+    }, content_type='multipart/form-data')
+
+    assert response.status_code == 200
+    body = response.data.decode()
+    assert 'Field missing: file' in body
+    assert 'value="Half Filled Challenge"' in body
+    assert 'A long description nobody wants to retype.' in body
+    assert 'value="CMO{typed_but_not_lost}"' in body
+    # Radios and label checkboxes come back ticked too.
+    assert 'value="Rust" checked' in body
+    assert 'value="5" checked' in body
+    assert 'value="Windows" checked' in body
+    assert 'value="ARM" checked' in body
+    assert 'value="Packer" data-label-class="1" checked' in body
+
+
+def test_background_submits_report_errors_as_json(
+        alice_client, db, alice, tmp_path, monkeypatch):
+    from app.controllers import crackme as crackme_controller
+
+    monkeypatch.setattr(crackme_controller, 'UPLOAD_FOLDER', str(tmp_path / 'pending'))
+    response = alice_client.post('/upload/crackme', data={
+        'name': 'No File Challenge', 'info': 'info', 'lang': 'C/C++',
+        'difficulty': '3', 'platform': 'Linux', 'arch': 'x86-64',
+    }, content_type='multipart/form-data',
+        headers={'X-Requested-With': 'XMLHttpRequest'})
+
+    assert response.status_code == 400
+    assert response.json == {'ok': False, 'error': 'Field missing: file'}
+
+
+def test_background_submits_get_the_confirmation_url_on_success(
+        alice_client, db, alice, tmp_path, monkeypatch):
+    from app.controllers import crackme as crackme_controller
+
+    monkeypatch.setattr(crackme_controller, 'UPLOAD_FOLDER', str(tmp_path / 'pending'))
+    response = alice_client.post('/upload/crackme', data={
+        'name': 'Ajax Challenge', 'info': 'info', 'lang': 'C/C++',
+        'difficulty': '3', 'platform': 'Linux', 'arch': 'x86-64',
+        'file': (BytesIO(b'binary'), 'challenge.bin'),
+    }, content_type='multipart/form-data',
+        headers={'X-Requested-With': 'XMLHttpRequest'})
+
+    assert response.status_code == 200
+    assert response.json == {'ok': True, 'redirect': '/upload/crackme/submitted'}
+    assert db.crackme.find_one({'name': 'Ajax Challenge'}) is not None
+
+    confirmation = alice_client.get('/upload/crackme/submitted')
+    assert b'Ajax Challenge' in confirmation.data
+    # One-shot: refreshing the confirmation doesn't re-announce the submission.
+    assert alice_client.get('/upload/crackme/submitted').status_code == 302
+
+
+def test_auto_validation_is_ticked_by_default_on_a_fresh_form(alice_client, alice):
+    body = alice_client.get('/upload/crackme').data.decode()
+
+    assert 'id="auto_validation" name="auto_validation" checked' in body
+    assert 'id="points" name="points" min="100" max="600" step="1"' in body
+    # Labels sit at the end of the form, after the auto-validation block.
+    assert body.index('Auto-validation') < body.index('Select all anti-analysis')
+
+
+def test_unticking_auto_validation_survives_a_rejected_upload(
+        alice_client, db, alice, tmp_path, monkeypatch):
+    from app.controllers import crackme as crackme_controller
+
+    monkeypatch.setattr(crackme_controller, 'UPLOAD_FOLDER', str(tmp_path / 'pending'))
+    response = alice_client.post('/upload/crackme', data={
+        'name': 'No Flag Here', 'info': 'info', 'lang': 'C/C++',
+        'difficulty': '3', 'platform': 'Linux', 'arch': 'x86-64',
+        # auto_validation deliberately absent: the user unticked it.
+    }, content_type='multipart/form-data')
+
+    body = response.data.decode()
+    assert 'id="auto_validation" name="auto_validation" checked' not in body