# Safety at BugClub HQ Practice targets, moderated conversations, stricter high school contact rules and parent involvement for students under 18. ## Permission comes before the first lab BugClub HQ teaches students to find security bugs in places they're allowed to look, then report them so they get fixed. Week 0 covers permission, ethics and the law before anyone starts week 1. Every student signs the [ethics agreement](https://bugclubhq.com/ethics). If they're under 18, a parent or guardian signs it too. Week 1 stays locked until the required signatures are in. Being ready to move ahead doesn't skip that step. ## Practice targets, with no real customers or data Every course lab is a practice app or a fake company built for the course. The bugs are there on purpose. In week 5, students research a fake company's public information. Nobody researches a classmate, a teacher or themselves. Students can also launch apps from the catalog, including OWASP Juice Shop and DVWA. These are open-source apps that are intentionally vulnerable. They aren't live production systems, so there are no real customers or data in them. Each sandbox is the student's own private copy. Nobody else is in it with them, and nothing they break affects another student's copy. Students keep sandbox access for a year after the course ends. ## The rules for every lab - **Only test the lab.** It's the only thing in scope. - **No real sites.** That includes BugClub HQ, your school and anything you find online. - **Use a harmless proof.** Bold text is enough. Nothing that reads data or touches other people. - **Stop once you've proven it.** Then write it up. Not sure something's allowed? Ask me first. A write-up that breaks the lab's rules doesn't count. Permission to use a practice target doesn't give a student permission to try the same thing elsewhere. That applies to tools they run, including AI tools. ## Who students talk to High school students have their own group. College students and adults meet in separate groups, on separate nights. Each group has its own live sessions and forums. BugClub HQ has no private messaging between students. Course discussion happens in the group's live sessions and forums. In each cohort's Questions and Finds forums, I approve every post before anyone else sees it. Private course threads are with me, about the student's own write-ups and the week 7 disclosure. College and adult students can also message me in BugClub HQ about anything in the course. The high school group has stricter contact rules, including for students who've turned 18. All contact with me stays in BugClub HQ and its group sessions. Students must not add, follow or message me on other accounts, and I don't accept their requests or reply there. I address it inside BugClub HQ and involve a parent or guardian if the student is under 18. For college and adult students, an ordinary follow or connection request isn't a rule violation on its own. Some of us may already know each other through tech. I don't solicit those connections or promise a response. Course support stays in BugClub HQ, and everyone must respect a request to stop contacting someone. The [instructor rules](https://bugclubhq.com/instructor-rules) explain the boundaries for each group. I don't have one-on-one course calls with high school students or contact them through personal accounts. Those boundaries apply to the whole high school group, including students who've turned 18. A parent of a student under 18 can ask me to turn the forums off. ## Live sessions and recordings Weeks 1 to 7 each have a group session on Zoom. Cameras are optional. Students can join with theirs off. Parents can watch a live session if they ask me first. I record every session for anyone who misses one and post the recording inside BugClub HQ for the group, without the chat. It's stored on Cloudflare R2. Only the group sees the link, though anyone who has the link can open it. Students must not share the recording or its link outside their group. Recordings are kept for three years. In recordings with students under 18, I remove names and anything else that identifies them. The [privacy policy](https://bugclubhq.com/privacy) explains how course data is stored and when it's deleted. ## Parents have their own account For a student under 18, a parent or guardian is involved from the application and the call onward. They sign the ethics agreement and have a separate account showing progress, write-up status and upcoming sessions. They also have their own thread with me. A student's notes, write-up content and feedback stay out of the parent account. Parents can ask me about any of it. [What a parent account shows](https://bugclubhq.com/parent-account) explains what is visible, what stays private and why. ## When something goes wrong If a student breaks the ethics agreement, their lab access pauses until I've talked it through with them. If they're under 18, I tell their parent or guardian within 12 hours and include them in that conversation. The [course rules](https://bugclubhq.com/course-rules) explain when a student can be removed and how the refund works. I never ask a student to keep anything from their parents. If I think a student under 18 is at risk, I tell their parent or guardian, even when it's something the student told me themselves. Where the law requires it, I also tell the authorities. If you're worried about something, tell me. Parents can use their parent-account thread or email [hello@bugclubhq.com](mailto:hello@bugclubhq.com). Students can raise it inside BugClub HQ. ## Questions before you apply? Email [hello@bugclubhq.com](mailto:hello@bugclubhq.com) and I'll answer it myself. You can also ask on the application call. If the applicant is under 18, a parent or guardian joins that call. - [Read the FAQ](https://bugclubhq.com/faq) - [Contact me](https://bugclubhq.com/contact) Applications for the winter term close Dec 18 ## The winter term $399 one time, only if accepted **Starts:** January 11 **Schedule** - High school students: Thursdays, 5:30 to 7 PM Eastern - College students: Wednesdays, 6 to 7:30 PM Eastern - Adults: Tuesdays, 8:15 to 9:45 PM Eastern **Class size:** Up to 12 per group [Apply for the winter term](https://bugclubhq.com/apply) Free to apply, about five minutes. You pay only if I accept the student.