In 2019 a 14-year-old named Grant Thompson found a bug in FaceTime that let you hear someone before they picked up. The bug was real and it was bad. Finding it was the easy part, though. The hard part, the part that actually got it fixed, was getting it in front of the right people at Apple.
That's most of the job, and it's what week 7 is for.
The fake company
Every student gets a little company website: a leadership page, a team page, a contact page and a security policy. The security policy says reports go to the CTO first. Some people list their email. The CTO doesn't. So they work it out from the pattern. If the CEO is john.doe@mycorp.test, Mike Smith is probably mike.smith@mycorp.test.
There are wrong answers sitting right there, too. Support, sales and press addresses are all on the site, and every one of them is the wrong place to send a security report. Kids who grab the first address they find learn something useful about reading the whole site before writing to anyone.
The email
Then they write the email. It needs a real subject line, the finding, the impact, the steps and the fix, and it has to read like someone trying to help. No threats, and no "pay me and I'll tell you." It "sends" to an inbox that only exists inside BugClub HQ.
BugClub HQ checks a few things the moment they hit send: whether it went to the right person, whether it has a subject, whether all four parts are there, and whether the tone is okay. Then I read it myself. Sometimes I write back as Mycorp's security team, with a question about step 3 or a thanks for sending it privately, because that's what happens in real life and they should get used to it here.
A passed disclosure earns the Disclosed badge and the title that goes with it.
