Codey says: capture the flags. Format H4H{...}
Sample platform: flags are checked in the browser, so anyone can read them in the source. Verify server-side in a real event.