They only hack apps built to be broken. You see how it's going every week.
BugClub HQ is an eight-week online course in ethical hacking for ages 14 to 17. You and your kid sign the ethics agreement before the first lab. I'm Josh, and I teach every live session and read every write-up.
Free to apply, about five minutes. $349 only if accepted, with a full refund any time in the first four weeks.
- Starts
- Jan 11
- Apply by
- Dec 18
- Live sessions
- Tuesdays, 7 to 8:30 PM Eastern
- Price
- $349 only if accepted
Safety and the law
Is this teaching my kid to hack?
It teaches them to find security bugs in places they're allowed to look, then report them properly. Testing a site without the owner's permission is illegal, and week 0 says so first.
Week 1 stays locked until you and your kid both sign the ethics agreement. Every lab is a practice app built to be broken, inside BugClub HQ. The one exception is week 5, when students look up what's public about themselves, and only with a guardian's opt-in. Without it, they use a sample profile.
The rules every lab opens with
Same idea as a real bug bounty program. Break them and the write-up doesn't count.
- Only test the lab. It's the only thing in scope.
- No real sites. That includes BugClub HQ, your school and anything you find online.
- Use a harmless proof. Bold text is enough. Nothing that reads data or touches other people.
- Stop once you've proven it. Then write it up. Not sure something's allowed? Ask me first.
Live sessions, messages and data
Who your kid talks to, and who sees it
Students can't message each other. These are the only places your kid talks to anyone in the course.
Live sessions
A 90-minute group session each week from week 1, on [FACT: live session platform]. Live sessions are recorded for anyone who misses one. The recording is posted inside BugClub HQ for the cohort, without the chat. [FACT: where recordings are hosted and whether the link works for anyone who has it]
The student forum
The only place students talk to each other. I review every post before it goes up, and you can turn the forums off for your kid.
One private thread, with me
About their own write-ups and the week 7 disclosure, inside BugClub HQ. You don't see what's in it, for the same reason you don't see their notes, but you can ask me about anything in it.
Live session details
- Cameras
- Cameras are optional. Students join with theirs on or off, whichever they're comfortable with.
- Devices
- [FACT: devices students can use]
- Can parents watch?
- [FACT: whether parents can watch live sessions]
- Recordings kept for
- [FACT: how long recordings are kept]
Your kid's data
I keep the application, your kid's account and what they do in the course: write-ups, notes, forum posts and progress. [FACT: where it's stored, who else can access it and when it's deleted]
Read the privacy policyInstructor
Who teaches your kid
One instructor for every cohort, so the person giving your kid feedback is the person running the class.
In [FACT: conviction year], I went to federal prison for internet piracy. It's the reason week 0 is about permission: I know exactly where that line is, and I'd like your kid to stay on the right side of it.
Background check: [FACT: background check status]
Your parent account
What you can see, and what stays private
What you can see
-
Progress and write-ups
Which weeks are done, what they're on now, their badges, and where each write-up stands: drafting, submitted, almost there or passed.
-
A two-line update every week
Built from what they actually did, so I can't pad it, and neither can your kid.
-
What's coming up
Live sessions, due dates and demo day ([FACT: demo day date]), which you're invited to.
-
Your own thread with me
Message me about anything: a missed session, a schedule clash, a worry you'd rather not raise in front of your kid. They don't see it.
What stays private
-
What they wrote, and what I said about it
You see where a write-up stands, not what's in it. You can ask me about any of it.
-
Their notes
Notes are where they try out half-formed ideas. They stop doing that the minute they think someone's reading over their shoulder.
-
The student forum and other students
Students and parents never share a forum, and you only ever see your own kid.
One parent account covers all your kids in the course, and a second guardian can have their own.
Cost and time
$349, paid once, only if they're accepted
One price for the whole course, in US dollars. No subscription, nothing else to buy, and nothing is charged when you apply.
- Length
- One self-paced week, then seven with a live session
- Each week
- [FACT: hours per week]
How you pay
Once your kid is accepted, I'll send you an invoice. [FACT: payment method]. Every payment and receipt shows up in your parent account.
Refunds
Full refund any time during the first four weeks (through [FACT: refund deadline]). I'll ask why, but the answer doesn't change whether you get it.
If $349 is a problem
Tell me on the call or email hello@bugclubhq.com. [FACT: what help looks like, e.g. lower price or sponsored seat]. It has no effect on whether your kid is accepted.
Schools, employers and scholarship programs can pay for seats, so families pay nothing. Ask about sponsoring.
Applying
How applying for your kid works
You can apply for your kid, or they can apply with your name and email. Either way you get every email about it.
-
Apply
About five minutes, free, and no account is created. One hard rule: they have to be 14 to 17 on January 11, 2027.
-
Hear back in 5 business days
I read every application myself and reply by email.
-
A call with me
If it looks like a fit, you and your kid get on a call with me, [FACT: call length and format, e.g. about 20 minutes by video]. Bring your questions.
-
Accounts and the agreement
If they're accepted, I set up both accounts and send you an invoice. Then you sign the ethics agreement with your kid before week 1.
If the cohort fills up, accepted applicants are first in line for the next one.
Questions parents ask first
Does my kid need to know how to code?
No. Every bug in the course can be found and explained with clicks and plain words, and there's nothing to install. I care about curiosity, not experience.
What if they miss a session or fall behind?
Every live session is recorded, so they can watch it later. [FACT: what happens with late write-ups and missed weeks]. If you're worried they're falling behind, message me from your parent account.
What happens if my kid breaks the rules?
A write-up that breaks a lab's rules doesn't count. [FACT: what happens if a student breaks the ethics agreement, and when a parent is told].
Why is there an application?
The class size is 6, and I want each place to go to a student who'll use it. The application confirms they'll be 14 to 17 when the course starts and that a parent or guardian knows about it, and it tells me what they're curious about. It isn't a test, and there's no wrong answer to the coding question.
What do they leave with?
Eight write-ups, a capstone report, a disclosure email a practice company answered, and a case file that stays theirs. They present the capstone at demo day ([FACT: demo day date]), and you're invited. There's no accredited certificate.
Applications for the winter cohort close Dec 18
The winter cohort
$349 one time, only if accepted
- Starts
- January 11
- Schedule
- Tuesdays, 7 to 8:30 PM Eastern
- Class size
- 6 students
Free to apply, about five minutes. You only pay if you're accepted.