Instructor # Who teaches BugClub HQ One instructor for every cohort: me. I teach every live session and read every write-up, so the person giving your kid feedback is the person running the class. [FACT: headshot] Josh [FACT: surname] Instructor for every BugClub HQ cohort [FACT: one-line background] ## My background [FACT: career, years in security, roles or types of clients, bug bounty or CVE record, talks] Some of it shows up in the course as short "My story" lessons: a time enumeration changed an engagement, an IDOR I found, and the best and worst disclosures I've seen. [See the eight weeks](https://bugclubhq.com/curriculum) ## I went to federal prison for internet piracy I'd rather you hear it from me than find it on your own, so here it is, plainly. **When:** [FACT: conviction year] **What it was:** [FACT: what it was, in plain words] **Sentence:** [FACT: sentence and release year] **Conditions still in effect:** [FACT: any supervised release or conditions still in effect, or none] It's the reason week 0 is about permission, before anyone opens a lab. The difference between security testing and breaking in is whether you were allowed to do it. I know exactly where that line is, and I'd like your kid to stay on the right side of it. [Read the ethics agreement your kid signs](https://bugclubhq.com/ethics) ## How I talk to students I talk like a normal person, not a teacher. Jokes, plain words, the occasional mild swear word. That doesn't make me their friend. I'm their instructor, and the lines below are how I keep it that way. ### Never okay, from me or from a student - Slurs. - Sexual jokes or comments. - Put-downs about someone's skill or who they are. - Comments about anyone's appearance. Students are held to the same lines, in live sessions and in the forum. ## The lines I hold with students [FACT: confirm every line below is true and enforced before deploying] 1. **All contact happens through BugClub HQ.** That means the BugClub HQ app and the group live sessions it links to on [FACT: live session platform]. No texting, phone calls, personal email, social media, Discord or gaming DMs with students. BugClub HQ emails students a copy of my feedback and replies, and those emails come from BugClub HQ's own address, not mine. 2. **I don't follow, friend or message students anywhere else.** Not on any platform, and I don't accept requests from them. 3. **No one-on-one calls.** I don't have video or voice calls alone with a student. Live sessions are group sessions. They're recorded for anyone who misses one, and the recording is posted inside BugClub HQ for the cohort, without the chat. [FACT: where recordings are hosted and whether the link works for anyone who has it]. The application call always includes a parent or guardian. 4. **The only private thread a student has is with me.** It lives inside BugClub HQ, and it's about their own work: my feedback on their write-ups, and the week 7 disclosure conversation, where I play the company. Once a message or a piece of feedback is sent, BugClub HQ has no way for me or the student to edit or delete it. [FACT: how long messages are kept; nothing in the code deletes them today]. Parents don't see what's in it, for the same reason they don't see notes: students stop trying out half-formed ideas the minute they think someone's reading over their shoulder. A parent can ask me about anything in it. 5. **I only look at a student's account as they see it when [FACT: when you use the view-as-student feature].** BugClub HQ lets me open a student's account the way they see it, notes included. Parents and other students never see their notes. 6. **Students only talk to each other in the forum, and I review every post first.** Students can't message each other. The student forum is the only place they talk, the other students in it can read everything, and I review every post before it appears. [FACT: each cohort's Finds forum posts without approval in the code today; turn approval on or change this line]. A parent can turn the forums off for their kid. 7. **I never ask a student to keep anything from their parents.** 8. **No meeting in person, no gifts, no money.** In either direction. Other than the course fee, no money changes hands. 9. **If a student contacts me outside BugClub HQ, I don't reply there.** I tell their parent. 10. **If I think a student is at risk, I tell their parent or guardian.** If a student tells me something that makes me think they're at risk, I tell their parent or guardian [FACT: and the authorities where required]. 11. **Students only research themselves in week 5 with a guardian's opt-in.** Week 5 is about what's public about a person online. A guardian gives the opt-in from their parent account. Without it, students use a sample profile, and the report works the same way. ## Background check Where it stands: [FACT: background check status]. [FACT: who ran the background check, when, and whether parents can see it]. ## References People who know me and my work. - [FACT: reference 1 name, role, how they know Josh, contact or available on request] - [FACT: reference 2 name, role, how they know Josh, contact or available on request] - [FACT: reference 3 name, role, how they know Josh, contact or available on request] ## Ask me anything Email [hello@bugclubhq.com](mailto:hello@bugclubhq.com), or ask on the application call. A parent or guardian is always on that call, and nothing on this page is off limits. - [For parents](https://bugclubhq.com/parents) - [Safety and the rules](https://bugclubhq.com/parents#safety) - [See the eight weeks](https://bugclubhq.com/curriculum) - [Read the FAQ](https://bugclubhq.com/faq) Applications for the winter cohort close Dec 18 ## The winter cohort $349 one time, only if accepted **Starts:** January 11 **Schedule:** Tuesdays, 7 to 8:30 PM Eastern **Class size:** 6 students [Apply for the winter cohort](https://bugclubhq.com/apply) Free to apply, about five minutes. You only pay if you're accepted.