FAQ # Questions from parents and students Every question, sorted by topic. Open one for the answer. Can't find yours? Email [hello@bugclubhq.com](mailto:hello@bugclubhq.com) and I'll get back to you. ## The basics ### Is it safe and legal? Students only ever test practice apps inside BugClub HQ that are built to be broken, and every lab states its rules and scope first. Testing a site without its owner's permission is illegal, so week 0 is about ethics and permission, and the student and a guardian both sign the ethics agreement before week 1 opens. The one exception is week 5, when students look up what's public about themselves, and only with a guardian's opt-in. Without it, they use a sample profile. Students can't message each other. The student forum is the only place they talk to each other, and I review every post before it goes up. The only private thread a student has is with me, about their own write-ups and the week 7 disclosure. Live sessions are group sessions. Live sessions are recorded for anyone who misses one. The recording is posted inside BugClub HQ for the cohort, without the chat. [FACT: where recordings are hosted and whether the link works for anyone who has it]. [Read the ethics agreement](https://bugclubhq.com/ethics), or see [safety and the rules](https://bugclubhq.com/parents#safety). ### Who teaches it? Me, Josh [FACT: surname]. [FACT: one-line background]. I teach every live session and read every write-up, in every cohort. In [FACT: conviction year], I went to federal prison for internet piracy. I'd rather you hear it from me than find it on your own. It's also why week 0 is about permission: I know exactly where that line is, and I'd like your kid to stay on the right side of it. Background check: [FACT: background check status]. [More about Josh, including the lines I hold with students](https://bugclubhq.com/about). ### What does it cost? $349 for the whole course, paid once, in US dollars, and only if your kid is accepted. Applying is free. No subscription, nothing else to buy. Full refund any time during the first four weeks (through [FACT: refund deadline]). If the price is a problem, [ask about financial help](#is-there-financial-aid). [See pricing](https://bugclubhq.com/curriculum#pricing). ### How much time does it take each week? About [FACT: hours per week] a week. That's the 90-minute live session, Tuesdays, 7 to 8:30 PM Eastern, plus the readings, a lab and a write-up, done on their own time during the week. Week 0 is self-paced and happens before week 1. If they miss a live session, the recording is there. ### Does my kid need to know how to code? No. Every bug in the course can be found and explained with clicks and words. No code, nothing to install. The fix is always what the server should have done, in plain English. I care about curiosity, not experience. The application asks how much coding they've done so I know where they're starting. ### What ages is it for? 14 to 17, on the day the cohort starts. For the winter cohort, that's January 11, 2027. A parent can apply for their kid, or a student can apply with a parent or guardian's name and email. Either way the guardian gets every email about the application. ### How do I apply? [Fill in the application](https://bugclubhq.com/apply). It takes about five minutes, costs nothing and doesn't create an account. It asks for the student's name, a parent or guardian's name and email, what the student is curious about, how much coding they've done and how you heard about BugClub HQ. It also asks whether the student will be 14 to 17 on January 11, 2027, and for you to agree to the [code of ethics](https://bugclubhq.com/ethics). I read every application and reply by email within 5 business days. If it looks like a fit, I set up a short call with the student, and a parent or guardian is on it too. If your kid is accepted, I set up the accounts and send you an invoice. ### Why is there an application? Each cohort is 6 students, so every write-up gets read properly, and I want every spot to go to a student who'll use it. The application confirms the student is 14 to 17 and that a parent or guardian knows about it, and it tells me what they're curious about. It isn't a test. I care about curiosity, not experience, and the coding question is only there so I know where they're starting. ### What will they actually learn? How to think like a security professional, then write it up like one. Each week covers one idea: trusting the client, mapping what's there, business logic, cross-site scripting, their own online footprint, and who owns what. Week 7 puts it together in a capstone and a disclosure email to a fake company. [See the eight weeks](https://bugclubhq.com/curriculum). ## Safety, privacy and the rules ### Is this teaching my kid to hack things? It teaches them to find security bugs in places they're allowed to look, then report them properly. Testing a site without the owner's permission is illegal, and week 0 says so before anything else. Every lab after that happens on practice apps inside BugClub HQ, and you'll read the whole ethics agreement and sign it with your kid before week 1. [Read the ethics agreement](https://bugclubhq.com/ethics). ### Will they be testing real websites? No. Testing a site without its owner's permission is against the law, and the course says so before anything else. The practice apps, the fake companies and the "sent" emails all live inside BugClub HQ. The one exception is week 5, when students look up what's public about themselves, and only with a guardian's opt-in. Without it, they use a sample profile. They also learn how real companies take security reports, so they know how to do it the right way later. ### What does week 5 involve? Week 5 is "OSINT: your own footprint." The recon they've practiced on fake apps works on real people too, so this week they turn it on themselves. With a guardian's opt-in, they look at what's public about themselves. Without it, they use a sample profile from the live session. Either way they file a personal footprint report: what they found, what the risk is and what they'll change. You give the opt-in, or don't, in your parent account, where you sign the ethics agreement. Students are told to keep anything that identifies them out of the forum. ### Who can my kid talk to in BugClub HQ? Students can't message each other. The student forum is the only place they talk to each other, and I review every post before it goes up. If you'd rather your kid stayed out of the forums, you can turn them off for your kid. The only private thread a student has is with me, inside BugClub HQ, about their own write-ups and the week 7 disclosure. [Every line I hold with students](https://bugclubhq.com/about#lines) is on the about page. ### Can I see what you say to my kid? You see where each write-up stands, not what's in it or what I said about it. The same goes for the week 7 disclosure conversation, where I play the company. That's the only private thread your kid has, and it's with me, inside BugClub HQ. The reason is the same as for their notes: students stop trying out half-formed ideas the minute they think someone's reading over their shoulder. You can ask me about anything in it. ### Who can see their work? They can, and I can. Parents see progress, badges, title and where each write-up stands, but not what's in it. Students never see each other's write-ups. Parents and other students never see their notes, and I see them only when [FACT: when you use the view-as-student feature]. ### What do you keep about my kid? Their name and email, and the work they do in BugClub HQ: notes, write-ups, forum posts and their messages with me. Live sessions are recorded too. Their write-ups and messages with me are seen only by them and me. Parents and other students never see their notes, and I see them only when [FACT: when you use the view-as-student feature]. [FACT: where it's stored, how long it's kept and how to ask for it to be deleted]. The full details are in the [privacy policy](https://bugclubhq.com/privacy). ## How the course works ### How long is it? Eight weeks, numbered 0 to 7. Week 0 is self-paced and happens before week 1. Weeks 1 to 7 each have one 90-minute live session, Tuesdays, 7 to 8:30 PM Eastern, plus readings, a lab and a write-up. ### When does it end? The winter cohort starts January 11, 2027. The last live session is [FACT: last session date], and demo day is [FACT: demo day date]. ### Is it live or self-paced? Both. One live session a week with me, and the recording stays up for the cohort if someone can't make it. Readings, labs and write-ups happen on their own time during the week. ### How do live sessions work? Weeks 1 to 7 each have one 90-minute group session, Tuesdays, 7 to 8:30 PM Eastern, on [FACT: live session platform]. Students join from a link inside BugClub HQ. Cameras are optional. Students join with theirs on or off, whichever they're comfortable with. Live sessions are recorded for anyone who misses one. The recording is posted inside BugClub HQ for the cohort, without the chat. [FACT: where recordings are hosted and whether the link works for anyone who has it]. [FACT: whether parents can watch live sessions]. ### What does my kid need? [FACT: devices students can use]. Nothing to install. For the live sessions, they join [FACT: live session platform] from a link inside BugClub HQ. ### What if they miss a week or fall behind? Live sessions are recorded for anyone who misses one, so they can catch up. Write-ups don't lock on the due date. They can still go in until the cohort ends. If they're falling behind, you'll see it in your parent account, and you can message me about it. ### What help do they get? Every write-up gets feedback from me: what's solid, what to sharpen, and one question to carry forward. If it's almost there, they revise it and send it back. Questions can go in the cohort forum or come to the live session. ### Are there grades? No. A write-up passes when every field has something real in it. If it doesn't, it comes back as "almost there" and they revise it. Nothing fails. There are no leaderboards and no comparisons, and a wrong prediction counts the same as a right one. ### What are the badges and titles? Each week has a badge, earned with that week's first write-up. Titles go Cadet, Scout, Investigator, Operative, Reporter and Disclosed, and they only ever move up. There's also a findings count: a private tally of what they've found that only goes up. None of it gets compared with anyone else's. ### What do they leave with? A case file with their write-ups from week 0 to week 7, a capstone report, a disclosure email to a practice company, a title and a demo day presentation. After that, there are student competitions they can enter now, [FACT: competitions to name, e.g. picoCTF or CyberPatriot], and bug bounty platforms once they're 18. ### Do you offer a certificate? No accredited certificate. What they keep is the work itself, saved in their case file. ## For students ### Will I have to be on camera? No. Cameras are optional. Students join with theirs on or off, whichever they're comfortable with. Live sessions are group sessions with the rest of your cohort. They're recorded for anyone who misses one, and the recording is posted inside BugClub HQ for the cohort, without the chat. The one time you present is demo day at the end of week 7, when you show your capstone to the cohort and the parents. ### Can my parents read what I write? No. They see where each write-up stands, your badges and your title. They don't see what's in your write-ups, your notes or my feedback. They also get a two-line update every week, built from what you actually did. Your thread with me is private too, but your parents can ask me about anything in it. The forum is different: the other students in it can read your posts, and I review every one before it goes up. ### What can I do with this after? Keep the work. Your case file holds every write-up from week 0 to week 7, your capstone report and your disclosure email. There are student competitions you can enter now, [FACT: competitions to name, e.g. picoCTF or CyberPatriot], and bug bounty platforms once you're 18. ## For parents ### What can I see as a parent? Progress by week, badges and title, where each write-up stands, live sessions, due dates and the ethics agreement. You also get a two-line update every week, built from what they actually did. [See what a parent account shows](https://bugclubhq.com/parents). ### Can I talk to you? Yes. Message me from your parent account about anything: a missed session, a schedule clash, how your kid is getting on. It's a private conversation, and your kid doesn't see it. ### My kid forgot their password. What do I do? Reset it from your parent account. You get a temporary password to pass on, and they pick a new one the next time they sign in. I can reset it too. ### Can I come to demo day? Please do. At the end of week 7 they present their capstone to the cohort and to the parents. Demo day is [FACT: demo day date], and you'll get an invite with the link. ## Cost, paying and applying ### How do I pay? Once your kid is accepted, I'll send you an invoice. [FACT: payment method] It's $349, once, in US dollars. No subscription, nothing else to buy. Nothing is charged when you apply. The payment and the receipt show up in your parent account. ### Can I get a refund? Yes. Full refund any time during the first four weeks (through [FACT: refund deadline]). I'll ask why, but the answer doesn't change whether you get it. [Read the refund policy](https://bugclubhq.com/refunds). ### Is there financial help? If $349 is a problem, tell me on the call or email [hello@bugclubhq.com](mailto:hello@bugclubhq.com). It has no effect on whether your kid is accepted. [FACT: what help looks like, e.g. lower price or sponsored seat]. ### Can my school or community group sponsor seats? Yes. A school, employer or scholarship program can pay for seats, so families have nothing to pay. [Email me](mailto:hello@bugclubhq.com?subject=Schools%20and%20sponsors) to set it up. Each student still applies, and I read every one. ### Why pay when there are free hacking sites? There are good free ones. What they don't have: a class of 6, a person who reads every write-up and says what to fix, a week on permission before anything else, and practice at the part most free sites skip, which is telling a company about a bug the right way. ### What happens on the call? The call is [FACT: call length and format, e.g. about 20 minutes by video]. It's mostly me asking what they're curious about and them asking me whatever they want. A parent or guardian is on the call too, so bring your questions. ### What if the cohort fills up? Each cohort is 6 students. If the winter cohort fills up, accepted applicants are first in line for the next one. ### Can students outside the US join? [FACT: whether students outside the US can join]. Live sessions are Tuesdays, 7 to 8:30 PM Eastern, and they're recorded for anyone who misses one. Still have a question?[Email hello@bugclubhq.com](mailto:hello@bugclubhq.com) Applications for the winter cohort close Dec 18 ## The winter cohort $349 one time, only if accepted **Starts:** January 11 **Schedule:** Tuesdays, 7 to 8:30 PM Eastern **Class size:** 6 students [Apply for the winter cohort](https://bugclubhq.com/apply) Free to apply, about five minutes. You only pay if you're accepted.