Who teaches BugClub HQ

[FACT: career, years in security, roles or types of clients, bug bounty or CVE record, talks]

Some of it shows up in the course as short "My story" lessons: a time enumeration changed an engagement, an IDOR I found, and the best and worst disclosures I've seen.

See the eight weeks

I'd rather you hear it from me than find it on your own, so here it is, plainly.

When

[FACT: conviction year]

What it was

[FACT: what it was, in plain words]

Sentence

[FACT: sentence and release year]

Conditions still in effect

[FACT: any supervised release or conditions still in effect, or none]

It's the reason week 0 is about permission, before anyone opens a lab. The difference between security testing and breaking in is whether you were allowed to do it. I know exactly where that line is, and I'd like your kid to stay on the right side of it.

Read the ethics agreement your kid signs

I talk like a normal person, not a teacher. Jokes, plain words, the occasional mild swear word. That doesn't make me their friend. I'm their instructor, and the lines below are how I keep it that way.

Never okay, from me or from a student

• Slurs.
• Sexual jokes or comments.
• Put-downs about someone's skill or who they are.
• Comments about anyone's appearance.

Students are held to the same lines, in live sessions and in the forum.

[FACT: confirm every line below is true and enforced before deploying]

1. All contact happens through BugClub HQ. That means the BugClub HQ app and the group live sessions it links to on [FACT: live session platform]. No texting, phone calls, personal email, social media, Discord or gaming DMs with students. BugClub HQ emails students a copy of my feedback and replies, and those emails come from BugClub HQ's own address, not mine.

2. I don't follow, friend or message students anywhere else. Not on any platform, and I don't accept requests from them.

3. No one-on-one calls. I don't have video or voice calls alone with a student. Live sessions are group sessions. They're recorded for anyone who misses one, and the recording is posted inside BugClub HQ for the cohort, without the chat. [FACT: where recordings are hosted and whether the link works for anyone who has it]. The application call always includes a parent or guardian.

4. The only private thread a student has is with me. It lives inside BugClub HQ, and it's about their own work: my feedback on their write-ups, and the week 7 disclosure conversation, where I play the company. Once a message or a piece of feedback is sent, BugClub HQ has no way for me or the student to edit or delete it. [FACT: how long messages are kept; nothing in the code deletes them today]. Parents don't see what's in it, for the same reason they don't see notes: students stop trying out half-formed ideas the minute they think someone's reading over their shoulder. A parent can ask me about anything in it.

5. I only look at a student's account as they see it when [FACT: when you use the view-as-student feature]. BugClub HQ lets me open a student's account the way they see it, notes included. Parents and other students never see their notes.

6. Students only talk to each other in the forum, and I review every post first. Students can't message each other. The student forum is the only place they talk, the other students in it can read everything, and I review every post before it appears. [FACT: each cohort's Finds forum posts without approval in the code today; turn approval on or change this line]. A parent can turn the forums off for their kid.

7. I never ask a student to keep anything from their parents.

8. No meeting in person, no gifts, no money. In either direction. Other than the course fee, no money changes hands.

9. If a student contacts me outside BugClub HQ, I don't reply there. I tell their parent.

10. If I think a student is at risk, I tell their parent or guardian. If a student tells me something that makes me think they're at risk, I tell their parent or guardian [FACT: and the authorities where required].

11. Students only research themselves in week 5 with a guardian's opt-in. Week 5 is about what's public about a person online. A guardian gives the opt-in from their parent account. Without it, students use a sample profile, and the report works the same way.

Where it stands: [FACT: background check status].

[FACT: who ran the background check, when, and whether parents can see it].

People who know me and my work.

• [FACT: reference 1 name, role, how they know Josh, contact or available on request]
• [FACT: reference 2 name, role, how they know Josh, contact or available on request]
• [FACT: reference 3 name, role, how they know Josh, contact or available on request]