[Applications for the winter cohort close Dec 18](https://bugclubhq.com/apply) # Your kid finds security bugs. Then reports them the right way. An online ethical hacking course for ages 14 to 17. Students break practice apps built to be broken, then write up what they found the way a security team expects to read it. One self-paced week, then seven live Tuesday sessions, about [FACT: hours per week] a week. Nobody needs to know how to code. [Apply for the winter cohort](https://bugclubhq.com/apply)[See the eight weeks](https://bugclubhq.com/curriculum) Free to apply, about five minutes. $349 only if accepted, with a full refund any time in the first four weeks. **Starts:** Jan 11 **Apply by:** Dec 18 **Live sessions:** Tuesdays, 7 to 8:30 PM Eastern **Price:** $349 only if accepted Safety and the rules ## Safe and legal, because permission comes first Testing a site without the owner's permission is illegal. That's the first thing I teach. - ### Permission before any lab Week 0 covers ethics and the law. Week 1 stays locked until your kid signs the ethics agreement, and so do you. [Read the agreement](https://bugclubhq.com/ethics). - ### Practice apps, never real sites Every lab runs on apps built to be broken. The one exception is week 5, when students look up what's public about themselves, and only with a guardian's opt-in. Without it, they use a sample profile. - ### Students can't message each other The forum is the only place they talk, and I review every post before it goes up. You can turn the forums off for your kid. - ### One private thread, and it's with me It's about their own write-ups and the week 7 disclosure. You don't see what's in it, but you can ask me about anything in it. [FACT: headshot] Josh [FACT: surname] Instructor [FACT: one-line background] [More about Josh](https://bugclubhq.com/about) I teach every cohort myself. I went to federal prison for internet piracy after a conviction in [FACT: conviction year], so I know exactly where the line is. That's [why week 0 is about permission](https://bugclubhq.com/blog/week-zero-permission). How a week works ## The same four steps every week 1. ### Read A real incident, the one idea behind it, and a story from me. 2. ### Attend 90 minutes live on Tuesday, in the week's practice app. Missed it? The recording is there. 3. ### Lab They write a guess down before they touch anything. A wrong guess counts the same as a right one, because the guess is the part that teaches. 4. ### Write it up, get feedback Seven fields on one page. I send back what's solid, what to sharpen and one question. A write-up passes or it's almost there. Nothing fails. The eight weeks ## Eight weeks, from permission to disclosure Weeks 1 to 7 each open with a real incident, then a lab with the same kind of bug. 1. Week 0: Self-paced ### Welcome, ethics and your first bug What ethical hacking actually means, how bug bounties work, and one idea that comes back every week: never trust the user. 2. Week 1: Trusting the browser (client-side trust) ### The day GitHub let a stranger in Every system trusts something about its users. This week it's the oldest one in web apps: the server believes whatever the page sends it. 3. Week 2: Mapping what's there (enumeration) ### How Parler gave itself away You map before you attack. A site that says "no such user" instead of "wrong password" is answering a question it didn't mean to. 4. Week 3: When the rules are the hole (business logic) ### The free coffee trick Negative quantities, one-time coupons that work twice, checkout steps you can skip. 5. Week 4: Messages that run as code (cross-site scripting) ### The worm that made a million friends When a site shows what you typed back as code instead of text, your message runs for everyone who sees it. 6. Week 5: Your own footprint (OSINT) ### The map that showed too much With a guardian's opt-in, students look up what's public about themselves. Without it, they use a sample profile. 7. Week 6: Someone else's stuff, one number away (IDOR) ### 885 million documents, one digit at a time A server that finds things by number but never checks who owns them will hand over someone else's stuff the moment you change the number. 8. Week 7: Capstone, report and disclosure ### The kid who found the bug Everything at once in one app, then the part the course builds toward: work out who to tell at a fake company, and tell them the right way. [Apply for the winter cohort](https://bugclubhq.com/apply)[See the eight weeks](https://bugclubhq.com/curriculum) At the end ## What they leave with - ### A write-up for every week In the format a security team expects, each with my feedback on it. - ### A capstone report Bugs from the whole course hidden in one app, written up as one report. - ### A disclosure that got an answer An email to a practice company's security contact, who writes back. - ### A Case File that stays theirs Their notes and write-ups stay in their account after the course ends. For students ## Real bugs, no grades, and your parents don't read your notes You'll find the same kinds of bugs behind real incidents at GitHub, MySpace and Parler, on apps built for it. No grades, no leaderboard. Your parents see your progress, not what you write. [Apply yourself](https://bugclubhq.com/apply?for=student) A parent or guardian signs the ethics agreement with you anyway. For parents ## What you see, and what stays private ### In your parent account - Progress by week - Their badges and title - Where each write-up stands - A two-line update every week, built from what they actually did - Whether the ethics agreement is signed ### Stays private - What they wrote, and my feedback on it - Their notes. They stop trying half-formed ideas the minute they think someone's reading over their shoulder. - The student forum and other students [For parents](https://bugclubhq.com/parents)[Safety and the rules](https://bugclubhq.com/parents#safety) [FACT: real student or pilot quotes, or confirm this is the first cohort] Don't take my word for it ## What you can check before you apply - [The full syllabus](https://bugclubhq.com/curriculum) Every week, lesson and lab. - [The ethics agreement](https://bugclubhq.com/ethics) What you and your kid sign before week 1. - [Why week 0 is about permission](https://bugclubhq.com/blog/week-zero-permission) What the first week covers, and why. - [The refund policy](https://bugclubhq.com/refunds) A full refund in the first four weeks. - [Who teaches it](https://bugclubhq.com/about) My background, including the prison part. - [hello@bugclubhq.com](mailto:hello@bugclubhq.com) Ask me anything before you apply. Questions ## The questions everyone asks first ### What does it cost? $349, paid once, only if your kid is accepted. Applying is free. Full refund any time during the first four weeks (through [FACT: refund deadline]). I'll ask why, but the answer doesn't change whether you get it. ### How much time does it take? About [FACT: hours per week] a week, including the live session, Tuesdays, 7 to 8:30 PM Eastern. Sessions are recorded for anyone who misses one. ### Do they need to know how to code? No. The labs run on clicks and words, and there's nothing to install. Devices: [FACT: devices students can use]. ### What happens after you apply? I reply within 5 business days. If it's a fit, I set up a short call with your kid and a parent or guardian. Once your kid is accepted, I'll send you an invoice. [FACT: payment method] [Read every question](https://bugclubhq.com/faq) [Applications for the winter cohort close Dec 18](https://bugclubhq.com/apply) ## The winter cohort starts January 11 Applying is free, takes about five minutes and doesn't create an account. [Apply for the winter cohort](https://bugclubhq.com/apply)