This is the same document every student signs, word for word. It's written to the student, because they're the one doing the work.
The student signs it in week 0 from their own account. A parent or guardian signs it from their parent account. Week 1 stays locked until both signatures are in.
Week 5 has its own opt-in. It's the one week students look up what's public about themselves, and only with a guardian's opt-in. Without it, they use a sample profile.
If you'd rather read it together on paper, this page prints cleanly.
The BugClub ethics agreement
This course teaches you how attackers think, so you can help fix what they would break. Those same skills can do real harm when they're pointed at the wrong thing. So before Week 1 opens, you sign this, and a parent or guardian signs it too.
Read all of it. If anything is unclear, ask your instructor before you sign. Your typed name is your signature.
What you're agreeing to
Only touch the targets you're given. Every playground, lab app and fake company in this course was built to be broken, and you have permission to break those. Nothing else is in scope. If a lesson or lab doesn't name something as a target, leave it alone, even when it looks related.
No real people, no real systems. Don't test any real website, app, network, phone or account. That includes BugClub HQ itself, your school, the games you play, and anyone's account but your own practice ones. Don't look up real people or try anything on them. The one exception is the Week 5 footprint exercise, which is about your own public information, and only if your parent or guardian opts in first.
Stop and report when you find something. Once you've shown a bug is real, stop. Don't dig further, don't collect anyone's data, don't show it off. Write it up so it can be fixed. If you ever come across a real problem outside this course, don't test it. Tell your instructor, and we'll help you report it the right way.
Help, never threaten. A report is how a bug gets fixed. Never ask for money or a favor in exchange for one, never threaten to make a bug public, and never hold a bug over anyone.
Keep it in the open. There are no private messages between students in BugClub. Ask questions in the cohort forum, where posts are reviewed, or ask your instructor. Don't move course talk into private chats with other students. Never share your password, and never ask for anyone else's.
Nothing leaves the app. The fake companies, the lab apps and the "sent" emails are all inert, and they stay that way. Don't take a technique you learned here and try it somewhere real, and don't post lab details or other students' work outside BugClub.
What happens if the agreement is broken
If you break this agreement, your lab access pauses until your instructor has talked it through with you and your parent or guardian. Honest mistakes happen, and the conversation is how we sort them out.
Testing a real system on purpose is the one that ends your place in the course. We mean that part plainly, because the whole point of BugClub is doing this work with permission.
What a parent or guardian is agreeing to
By signing, you confirm that the student is 14 to 17 years old, that you've read these rules with them, and that you're giving permission for them to take part in the hands-on labs described here.
You're agreeing that the work happens only on the practice targets the course provides, and that the skills are being taught so your child can help fix security problems, not cause them. You can reach the instructor any time through your parent account if you have a question or a concern.
If the agreement changes
If we update this agreement, you and your parent or guardian both sign the new version before your next week opens.