Permission comes before the first lab
BugClub HQ teaches students to find security bugs in places they're allowed to look, then report them so they get fixed. Week 0 covers permission, ethics and the law before anyone starts week 1.
Every student signs the ethics agreement. If they're under 18, a parent or guardian signs it too. Week 1 stays locked until the required signatures are in. Being ready to move ahead doesn't skip that step.
Practice targets, with no real customers or data
Every course lab is a practice app or a fake company built for the course. The bugs are there on purpose. In week 5, students research a fake company's public information. Nobody researches a classmate, a teacher or themselves.
Students can also launch apps from the catalog, including OWASP Juice Shop and DVWA. These are open-source apps that are intentionally vulnerable. They aren't live production systems, so there are no real customers or data in them.
Each sandbox is the student's own private copy. Nobody else is in it with them, and nothing they break affects another student's copy. Students keep sandbox access for a year after the course ends.
The rules for every lab
- Only test the lab. It's the only thing in scope.
- No real sites. That includes BugClub HQ, your school and anything you find online.
- Use a harmless proof. Bold text is enough. Nothing that reads data or touches other people.
- Stop once you've proven it. Then write it up. Not sure something's allowed? Ask me first.
A write-up that breaks the lab's rules doesn't count. Permission to use a practice target doesn't give a student permission to try the same thing elsewhere. That applies to tools they run, including AI tools.
Who students talk to
High school students have their own group. College students and adults meet in separate groups, on separate nights. Each group has its own live sessions and forums.
BugClub HQ has no private messaging between students. Course discussion happens in the group's live sessions and forums. In each cohort's Questions and Finds forums, I approve every post before anyone else sees it. Private course threads are with me, about the student's own write-ups and the week 7 disclosure. College and adult students can also message me in BugClub HQ about anything in the course.
The high school group has stricter contact rules, including for students who've turned 18. All contact with me stays in BugClub HQ and its group sessions. Students must not add, follow or message me on other accounts, and I don't accept their requests or reply there. I address it inside BugClub HQ and involve a parent or guardian if the student is under 18.
For college and adult students, an ordinary follow or connection request isn't a rule violation on its own. Some of us may already know each other through tech. I don't solicit those connections or promise a response. Course support stays in BugClub HQ, and everyone must respect a request to stop contacting someone. The instructor rules explain the boundaries for each group.
I don't have one-on-one course calls with high school students or contact them through personal accounts. Those boundaries apply to the whole high school group, including students who've turned 18. A parent of a student under 18 can ask me to turn the forums off.
Live sessions and recordings
Weeks 1 to 7 each have a group session on Zoom. Cameras are optional. Students can join with theirs off. Parents can watch a live session if they ask me first.
I record every session for anyone who misses one and post the recording inside BugClub HQ for the group, without the chat. It's stored on Cloudflare R2. Only the group sees the link, though anyone who has the link can open it. Students must not share the recording or its link outside their group.
Recordings are kept for three years. In recordings with students under 18, I remove names and anything else that identifies them. The privacy policy explains how course data is stored and when it's deleted.
Parents have their own account
For a student under 18, a parent or guardian is involved from the application and the call onward. They sign the ethics agreement and have a separate account showing progress, write-up status and upcoming sessions. They also have their own thread with me.
A student's notes, write-up content and feedback stay out of the parent account. Parents can ask me about any of it. What a parent account shows explains what is visible, what stays private and why.
When something goes wrong
If a student breaks the ethics agreement, their lab access pauses until I've talked it through with them. If they're under 18, I tell their parent or guardian within 12 hours and include them in that conversation. The course rules explain when a student can be removed and how the refund works.
I never ask a student to keep anything from their parents. If I think a student under 18 is at risk, I tell their parent or guardian, even when it's something the student told me themselves. Where the law requires it, I also tell the authorities.
If you're worried about something, tell me. Parents can use their parent-account thread or email hello@bugclubhq.com. Students can raise it inside BugClub HQ.