Challenge: “Is there something hidden behind the scenes?”

My initial, and correct, feeling was, I need to inspect the source of the site. Scrolling over all .js files one quickly finds a piece of dead code in CTFd.js:

function findFlag() {
  $.get(script_root + '/api/v1/challenges/solveFlag', function(response) {
    console.log(response);
  });
}

Flag: xmas{flAg1sC0mINgtoT0wN}

What did I learn: Always look at the source.