Skip to content

Pricing

$399 USD, paid once, only if I accept you. The full eight-week course and a year of sandbox access after it ends.

One price, paid once

$399 covers the whole course and a year of sandbox access after it ends. You pay nothing unless I accept you.

How To Be Good

$399 USD

You pay once. There's no subscription and nothing else to buy.

Apply for the winter term

Free to apply, about five minutes.

Includes

  • Seven live sessions and the recordings
  • A lab every week, plus extra challenges
  • Feedback from me on every write-up
  • Your own sandboxes, during the course and for a year after
  • Your Case File, for a year after the course ends
  • A parent account, if you're under 18

How paying works

  1. Apply for free

    It takes about five minutes. You don't create an account or enter a card.

  2. Hear back within a day

    If it looks like a fit, I'll set up a call. It's about 20 minutes by video, and if you're under 18, a parent or guardian joins it.

  3. Pay once I accept you

    The bill goes to you, or to a parent or guardian if you're under 18. You can pay by card, or I can send an invoice. Receipts and refund notices come by email, and if there's a parent account, they show up there too.

$399 also covers

  • Your own sandboxes

    Launch your own private copy of any app in the catalog. Nobody else is in it, and nothing you break affects another student. It stops after 30 idle minutes and starts again when you come back. You can stop it or delete it yourself, and your notes and reports stay either way.

  • The app catalog

    On top of the weekly labs, there's a catalog of well-known open-source apps that are intentionally vulnerable, like OWASP Juice Shop and DVWA. People in security have practiced on these for years. They aren't live production systems, so there are no real customers or data in them. You can launch any of them from day one.

  • Reports on any app

    You can file a report on any app you launch, not only the week's lab, and tie it to the sandbox you found the bug in. While the course runs, I read those too.

  • Notes in your Case File

    Your Case File holds your write-ups, reports and notes. A note can link to the week, app, sandbox or report it's about, so you can find it again three months later. You can also print your submitted write-ups as a portfolio.

  • The Library

    The Library has the program rules, a glossary of twenty terms and outside reading, like the OWASP Top 10 and CERT's guide to coordinated disclosure.

  • A year after the course

    Your sandbox access runs for a year after your course ends, so you can keep launching apps from the catalog and filing reports on them.

Refunds

You can get a full refund any time during the first four weeks of the course. I'll ask why, but your answer doesn't change whether you get it. The details are in the refund policy.

Help with the cost

If $399 is a problem, tell me on the call or email hello@bugclubhq.com. We'll work out something fair, like a lower price, a payment plan or a sponsored seat. Money won't be what keeps you out, and asking has no effect on whether I accept you.

Sponsored seats

Schools, employers and scholarship programs can pay for seats, so the student pays nothing. Email hello@bugclubhq.com to set one up, or see pricing for schools.

Questions before you apply?

Email hello@bugclubhq.com and I'll answer it myself. You can also ask on the application call. If the applicant is under 18, a parent or guardian joins that call.

Applications for the winter term close Dec 18

The winter term

$399 one time, only if accepted

Starts
January 11
Schedule
  • High school students: Thursdays, 5:30 to 7 PM Eastern
  • College students: Wednesdays, 6 to 7:30 PM Eastern
  • Adults: Tuesdays, 8:15 to 9:45 PM Eastern
Class size
Up to 12 per group
Apply for the winter term

Free to apply, about five minutes. You pay only if I accept the student.