Cipherfall

Cipherfall FAQ

Frequently asked questions about VV26 and Prompt2Pwn cards and the Victory Point Race game mode.

Cipherfall

Cipherfall is a card gaming system built around the concepts of cybersecurity attack and defense. Each card represents a different tactic or vulnerability in the digital landscape. Cards have their own abilities and mechanics that can be combined to create strategic decks, some focused on aggressive offense (pushing opponent vulnerabilities to failure), others on robust defense (strengthening your own position), and many balancing both attack and defense.

Card Rules

Q: What is "self-damage" and how does it affect a card?

A: Some cards have effects that increase their own VC (making it harder to reach 0 and win). Examples include:

  • Irresponsible Disclosure (#08): Rolling a 1 causes the card to attack itself for 1 damage
  • Rolling Brownouts (#17): Attacks all cards, including itself
  • Autocomplete Disaster (#29): Must include itself in the target list when rolling

Self-damage moves the card toward the losing condition (35 VC), making these cards harder to win with.

Q: What does a negative action value mean?

A: A negative action value resolves to zero, not the opposite action:

  • Attack −4 = Attack 0 (does no damage; it is not Defend 4)
  • Defend −2 = Defend 0 (does no protection; it is not Attack 2)

When you roll a negative result, the action fails to deliver any value. It is wasted, not converted or reversed.

Q: How does Incident Response Team (#09) scale with duplicates?

A: Incident Response Team (#09)'s defense output increases dramatically with multiple copies:

  • With 1 copy: Defend 1d6 to any chosen target per activation
  • With 2 copies: Defend 1d6 to two different targets per activation (same activation)

The second copy doesn't replace the first; both activate together, allowing you to distribute defense across multiple of your cards in a single turn.

Q: How does Silver Bullet (#13)'s once-per-game trigger work?

A: Silver Bullet (#13) has a special mechanic that delays your victory:

  1. Your card would reach 0 VC (normally you'd earn 1 VP)
  2. Instead, the trigger fires: Attack 3d4 vs all opponents
  3. The card stays in play with its current VC
  4. You must push it to 0 VC again through normal play to actually earn the VP

This creates a two-stage mechanic: a "last stand" attack before claiming victory.

Q: How does The Blackout (#12) split damage across multiple players?

A: The Blackout (#12) splits its total roll evenly among all players:

Example: 2d6 = 9, three players at the table

  • 9 ÷ 3 = 3 damage per player (rounded down)
  • Each player takes 3 VC damage
  • The 1 unassigned point is lost

If the split isn't even, the remainder is discarded, not allocated to anyone.

Q: Does The Blackout (#12)'s +1d4 bonus apply once per activation or permanently?

A: Once per activation. When you activate The Blackout (#12), you choose to boost either Attack or Defend by adding 1d4 to that activation only. The next activation, you choose again from scratch; it's not a permanent stat buff.

Q: How does Watering Hole (#06) work with doubles?

A: When you roll 2d6 with Watering Hole (#06):

  • Use the higher die for Attack
  • Use the lower die for Defend
  • If both dice match (doubles): Also Attack 2 vs the next opponent card to activate

The doubles bonus adds a small burst of extra offensive pressure when you get lucky.

Q: Can Hacker (#35) choose the same option twice?

A: No. Hacker (#35) has three distinct options:

  1. Attack 1d6
  2. Defend 1d6
  3. Defend 1d6 + 1 to a different friendly card

When you "choose two," you must select 2 different options from these 3. You cannot pick the same option twice.

Q: What happens if Live Demo (#22) activates but no attack card has been activated yet?

A: Live Demo (#22) reads: "Attack 2d6 − 1d4 against the most recently activated attacking card."

If no attack card has been activated yet, there is no valid target. The activation has no effect and is wasted. Live Demo (#22) is best saved for later in the game when attack cards have already been played.

Q: How does Live Demo (#22) determine its target?

A: Live Demo (#22) targets the card that initiated the attack, not the player who was attacked. This has three important mechanics:

  1. Correct targeting: If you activate Script Kitty (#04) to attack an opponent, then activate Live Demo (#22), Live Demo targets Script Kitty, not the opponent's card that Script Kitty attacked.
  2. Your own cards can be targets: If you activate your own cards in sequence and one of them attacks, Live Demo will target that card (one of your own). Be careful about activation order.
  3. Self-targeting on repeat: If you activate Live Demo (#22) twice in one turn, the second activation targets Live Demo (#22) itself. After the first activation, Live Demo becomes the most recently activated attacking card, so the second activation attacks Live Demo's own card.

Q: Can I defend an opponent's card?

A: Yes. You may choose to defend any card in play, including an opponent's card. When you do:

  • The opponent's card gains that defense value
  • Their VC moves closer to 0 VC
  • When their card reaches 0 VC, the opponent earns 1 VP (even though you helped defend it)

This is a legal (if unusual) play: you can sacrifice 1 VP to the scoreboard if removing that card quickly is strategically important.

Q: How does 3rd-Party Risk Register (#32) determine its attack value?

A: The attack value is dynamically calculated based on the card's current VC:

  • Starting VC = 10: X = 1 (Attack = 4d4 − 1)
  • VC drops to 9: X = 9 (Attack = 4d4 − 9)
  • VC near 35: X = 3 (Attack = 4d4 − 3)

The card has a U-shaped power curve, strongest at full health (X = 1) and near-death (X = 3), weakest at single digits (9 VC). Single-digit VC (1-9) uses that digit as X directly. X is never 0.

Q: For Fedora Salesman (#27), do your own attack actions count toward token gain?

A: Yes. Fedora Salesman (#27) says "for each attack action by any player," which includes both your attacks and your opponents' attacks. Tokens accumulate passively whenever anyone at the table activates an attack ability. Token accumulation is not an attack action itself.

If you have multiple Fedora Salesmen in play, each one earns tokens independently on every attack action; their token triggers are separate from each other.

Q: Are Responsible Disclosure (#24) and Security Awareness Training (#30) broken?

A: No, these are intentional tradeoff mechanics. Both cards were designed to have negative attack values in exchange for strong defensive support:

Responsible Disclosure (#24):

  • Attacks opponent cards for +4 damage (but also defends opponents)
  • Defends 1d4 to all cards, including opponents
  • Design: Thematic "responsible disclosure" that benefits everyone

Security Awareness Training (#30):

  • Must choose X−1 cards, including at least 1 opponent
  • Defends X+1 to each chosen card
  • Design: Training that spreads defensive knowledge across the board, even to opponents

Both are balanced tradeoffs: accept the negative attack in exchange for strong defensive support. Use them when you need durability over pure damage.

Q: What about Shared Admin Account (#33) and its 2 VP penalty?

A: Shared Admin Account (#33) reverses the normal outcome when eliminated:

Normal: When a card reaches 35 VC, the opponent earns 1 VP.

Shared Admin Account (#33): When this card reaches 35 VC, the opponent earns 2 VP (not 1).

This makes the card extremely risky. Opponents will prioritize attacking it because it's worth double the normal VP reward.

Q: What does Senate Hearing (#21) do?

A: Senate Hearing (#21) is a token accumulator:

  • Each activation puts 1d4 + 1d6 tokens (average 6 per activation) on the card
  • Once per game, you can remove 60 tokens to earn 2 VP
  • Challenge: You need ~10 activations to accumulate 60 tokens
  • Bigger challenge: The card only has 5 VC, so opponents can eliminate it in 1-2 hits before you collect tokens

This is a high-risk, high-reward card that rewards deep deck strategies designed to keep it alive long enough to accumulate tokens.

Prompt2Pwn (P2P)

Answers about Prompt2Pwn (P2P) card interactions in Victory Point Race. Read these alongside the card text and the VPR rules.

Prompt Injection (#05): Can I activate it before any die has been rolled this turn?

No. Prompt Injection needs a die result from the current turn. In Victory Point Race (VPR), the turn-opening activation roll supplies one. Repeat the most recent physical die result without rolling again; do not use the total of a multi-die roll.

Frontier Guardrails (#02): Does a stored die replace a whole roll?

No. Each stored die replaces one individual die. Remove the stored die when you use it. To use an opponent’s stored die, Defend 2 to that Frontier Guardrails card. Using a stored result is not a new physical roll and does not update Memory.md or the last-die history. Stored dice cannot replace the turn-opening activation roll.

Race Condition (#04): Which player counts as the last roller?

Check who rolled the most recent physical die before rolling for Race Condition itself. If you rolled it, use Attack 1d6 + 1. If an opponent rolled it, use Defend 1d6 + 3.

Memory.md (#09): Which results does it store?

While in play, Memory.md automatically stores up to the two most recent physical die results rolled by any player. Store individual die values, not a roll’s total. When you activate it, use the total stored value for the chosen Attack or Defend effect, then clear the stored values. A substituted Frontier Guardrails result does not add a new stored value.

Model Consensus (#12): Can I stack activations?

Yes. Each activation allows up to two optional die upgrades in the next card roll: 1d4 becomes 1d6, and 1d6 becomes 2d4. For example, two activations allow all three dice in a following 3d4 roll to become 3d6. You may choose fewer upgrades. After that roll, any unused upgrades are cleared.

Model Consensus (#12): Can it increase my turn-opening activation roll?

No. Model Consensus applies to the next card roll, not the roll at the start of a turn that determines how many activations you receive.

Model Consensus (#12): What if an upgraded roll falls outside a card’s listed results?

Only the card’s explicitly listed ranges resolve an effect. An upgraded result outside those ranges has no effect; do not extend a range to include it.

Exploit Chain (#08): Are its token effects optional?

Yes. During its Defend 3 activation, you may remove 15 tokens to gain 1 VP once per game; this does not cost a second activation. If damage would take the card to 35 or more VC, you may remove 8 tokens to negate that damage. The 8-token protection can be used again on later damage events if enough tokens remain.

Synthetic Insider (#13): Who chooses X when an opponent Defends?

The player who controls Synthetic Insider chooses how many available tokens to remove, including zero. The resulting Attack X targets the card that was defended. In team play, opponents are players on the opposing team.

Sandbox Escape (#14): Must I use the once-per-game effect on an 11–12?

No. On an 11 or 12, you may choose the once-per-game Attack 2d6 + Defend 2d6 effect instead of the ordinary Attack X − 1. Its Attack and Defend targets must be different. If you decline, resolve the ordinary attack and keep the once-per-game effect available for a later qualifying roll.

Victory Point Race

Victory Point Race (VPR) is the game mode being introduced alongside the Vulnerability Vibes 2026 (VV26) card set. The same cards can be used in other game modes with different rules; the mechanics here are specific to Victory Point Race (VPR).

Setup

Q: After "Keep 2, Discard 1, Pass 1", do I start with 2 or 3 cards?

A: You start with 3 cards:

  1. You are dealt 4 cards
  2. You keep 2 and discard 1 (still have 2 in hand)
  3. You receive 1 card passed clockwise from the player to your right
  4. Net result: 2 + 1 = 3 cards at game start

Core Rules

Q: What are the win conditions in Victory Point Race?

A: Victory Point Race uses a Victory Point (VP) system where:

  • Your card reaches 0 VC: You earn 1 VP (that's good, you want this)
  • Opponent's card reaches 35 VC: The opponent earns 1 VP (that's bad, you want to prevent this)
  • First player to 3 VP wins

This creates two paths to victory:

  1. Offense (Attacker path): Use Attack abilities to push opponent cards toward 35 VC
  2. Defense (Defender path): Use Defend abilities to push your own cards toward 0 VC

Q: Can the same card activate more than once in a single turn?

A: Yes, unless the card explicitly forbids it. Only one card has this restriction:

  • Irresponsible Disclosure (#08): "This card may not be activated more than once per turn"

At the start of each turn, you roll 1d4 to determine how many activations you have. All other cards can be activated multiple times if you have activations remaining.

Multiplayer

Q: How does "split across all players" work in a 3+ player game?

A: Cards like The Blackout (#12) that split their attack across all players, including the player who controls the card, divide the total roll equally among all players at the table:

Example: 3-player game, The Blackout (#12) rolls 9

  • 9 ÷ 3 = 3 damage per player (rounded down)
  • Each player takes 3 VC damage
  • The remainder (1 point) is lost

The card weakens proportionally as player count increases.

Q: In a 3+ player game, do attacks still target just one opponent?

A: Yes, unless the card explicitly says "all players" or "all opponents." Most attacks target a single opponent's card. Only cards with explicit split or AOE mechanics affect multiple players.

Q: How does Shared Admin Account (#33)'s 2 VP penalty work in multiplayer?

A: The player who deals the killing blow earns the VPs. If Shared Admin Account (#33) reaches 35 VC:

  • The player who dealt that damage earns 2 VP (not 1)
  • In a 3+ player game, whoever attacks Shared Admin Account (#33) to 35 VC claims both points

Q: How does the card passing at the start of the game work in multiplayer?

A: At the start of the game, after the "Keep 2, Discard 1" phase, each player passes one card to the player on their left (clockwise). This means that in a 3-player game, Player A gives a card to Player B, Player B gives a card to Player C, and Player C gives a card to Player A. In a 4-player game, the passing continues in the same clockwise direction. This adds an element of strategy right from the start, as you can try to pass a less useful card to your opponents while keeping stronger cards for yourself.

Q: How many players can play Victory Point Race?

A: Victory Point Race can be played with 2 or more players. The game scales well with additional players, but keep in mind that the dynamics will change as more players join, especially with cards that affect all players or have split damage mechanics. The optimal player count is typically 2-4 for the best balance of strategy and interaction.