diff --git a/repochecker/epita/flags.go b/repochecker/epita/flags.go
index ac886457..0c76289c 100644
--- a/repochecker/epita/flags.go
+++ b/repochecker/epita/flags.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"fmt"
+	"strings"
 	"unicode"
 
 	"srs.epita.fr/fic-server/libfic"
@@ -18,5 +19,19 @@ func EPITACheckKeyFlag(flag *fic.FlagKey, raw string) (errs []error) {
 		errs = append(errs, fmt.Errorf("Label should not end with punct (%q). Reword your label as a description of the expected flag, `:` are automatically appended.", flag.Label[len(flag.Label)-1]))
 	}
 
+	if strings.HasPrefix(strings.ToLower(raw), "cve-") && flag.Type != "ucq" {
+		errs = append(errs, fmt.Errorf("CVE numbers are required to be UCQ with choice_cost"))
+	}
+
+	return
+}
+
+func EPITACheckKeyFlagWithChoices(flag *fic.FlagKey, raw string, choices []*fic.FlagChoice) (errs []error) {
+	if len(choices) < 10 && flag.ChoicesCost == 0 {
+		errs = append(errs, fmt.Errorf("requires at least 10 choices to avoid brute-force"))
+	} else if len(choices) < 6 && flag.ChoicesCost > 0 {
+		errs = append(errs, fmt.Errorf("requires at least 10 choices to avoid brute-force"))
+	}
+
 	return
 }
diff --git a/repochecker/epita/main.go b/repochecker/epita/main.go
index 99f3c321..93402f6e 100644
--- a/repochecker/epita/main.go
+++ b/repochecker/epita/main.go
@@ -6,5 +6,6 @@ import (
 
 func RegisterChecksHooks(h *sync.CheckHooks) {
 	h.RegisterFlagKeyHook(EPITACheckKeyFlag)
+	h.RegisterFlagKeyWithChoicesHook(EPITACheckKeyFlagWithChoices)
 	h.RegisterFileHook(EPITACheckFile)
 }