Your kid finds security bugs. Then reports them the right way.
An online ethical hacking course for ages 14 to 17. Students break practice apps built to be broken, then write up what they found the way a security team expects to read it. One self-paced week, then seven live Tuesday sessions, about [FACT: hours per week] a week. Nobody needs to know how to code.
Free to apply, about five minutes. $349 only if accepted, with a full refund any time in the first four weeks.
- Starts
- Jan 11
- Apply by
- Dec 18
- Live sessions
- Tuesdays, 7 to 8:30 PM Eastern
- Price
- $349 only if accepted
price to 0.01
3Press Buy. The order costs one cent
Safety and the rules
Safe and legal, because permission comes first
Testing a site without the owner's permission is illegal. That's the first thing I teach.
-
Permission before any lab
Week 0 covers ethics and the law. Week 1 stays locked until your kid signs the ethics agreement, and so do you. Read the agreement.
-
Practice apps, never real sites
Every lab runs on apps built to be broken. The one exception is week 5, when students look up what's public about themselves, and only with a guardian's opt-in. Without it, they use a sample profile.
-
Students can't message each other
The forum is the only place they talk, and I review every post before it goes up. You can turn the forums off for your kid.
-
One private thread, and it's with me
It's about their own write-ups and the week 7 disclosure. You don't see what's in it, but you can ask me about anything in it.
I teach every cohort myself. I went to federal prison for internet piracy after a conviction in [FACT: conviction year], so I know exactly where the line is. That's why week 0 is about permission.
How a week works
The same four steps every week
-
1 Read
A real incident, the one idea behind it, and a story from me.
-
2 Attend
90 minutes live on Tuesday, in the week's practice app. Missed it? The recording is there.
-
3 Lab
They write a guess down before they touch anything. A wrong guess counts the same as a right one, because the guess is the part that teaches.
-
4 Write it up, get feedback
Seven fields on one page. I send back what's solid, what to sharpen and one question. A write-up passes or it's almost there. Nothing fails.
The eight weeks
Eight weeks, from permission to disclosure
Weeks 1 to 7 each open with a real incident, then a lab with the same kind of bug.
-
Welcome, ethics and your first bug
What ethical hacking actually means, how bug bounties work, and one idea that comes back every week: never trust the user.
-
The day GitHub let a stranger in
Every system trusts something about its users. This week it's the oldest one in web apps: the server believes whatever the page sends it.
-
How Parler gave itself away
You map before you attack. A site that says "no such user" instead of "wrong password" is answering a question it didn't mean to.
-
The free coffee trick
Negative quantities, one-time coupons that work twice, checkout steps you can skip.
-
The worm that made a million friends
When a site shows what you typed back as code instead of text, your message runs for everyone who sees it.
-
The map that showed too much
With a guardian's opt-in, students look up what's public about themselves. Without it, they use a sample profile.
-
885 million documents, one digit at a time
A server that finds things by number but never checks who owns them will hand over someone else's stuff the moment you change the number.
-
The kid who found the bug
Everything at once in one app, then the part the course builds toward: work out who to tell at a fake company, and tell them the right way.
At the end
What they leave with
-
A write-up for every week
In the format a security team expects, each with my feedback on it.
-
A capstone report
Bugs from the whole course hidden in one app, written up as one report.
-
A disclosure that got an answer
An email to a practice company's security contact, who writes back.
-
A Case File that stays theirs
Their notes and write-ups stay in their account after the course ends.
For students
Real bugs, no grades, and your parents don't read your notes
You'll find the same kinds of bugs behind real incidents at GitHub, MySpace and Parler, on apps built for it. No grades, no leaderboard. Your parents see your progress, not what you write.
A parent or guardian signs the ethics agreement with you anyway.
For parents
What you see, and what stays private
In your parent account
- Progress by week
- Their badges and title
- Where each write-up stands
- A two-line update every week, built from what they actually did
- Whether the ethics agreement is signed
Stays private
- What they wrote, and my feedback on it
- Their notes. They stop trying half-formed ideas the minute they think someone's reading over their shoulder.
- The student forum and other students
[FACT: real student or pilot quotes, or confirm this is the first cohort]
Don't take my word for it
What you can check before you apply
- The full syllabus Every week, lesson and lab.
- The ethics agreement What you and your kid sign before week 1.
- Why week 0 is about permission What the first week covers, and why.
- The refund policy A full refund in the first four weeks.
- Who teaches it My background, including the prison part.
- hello@bugclubhq.com Ask me anything before you apply.
Questions
The questions everyone asks first
What does it cost?
$349, paid once, only if your kid is accepted. Applying is free. Full refund any time during the first four weeks (through [FACT: refund deadline]). I'll ask why, but the answer doesn't change whether you get it.
How much time does it take?
About [FACT: hours per week] a week, including the live session, Tuesdays, 7 to 8:30 PM Eastern. Sessions are recorded for anyone who misses one.
Do they need to know how to code?
No. The labs run on clicks and words, and there's nothing to install. Devices: [FACT: devices students can use].
What happens after you apply?
I reply within 5 business days. If it's a fit, I set up a short call with your kid and a parent or guardian. Once your kid is accepted, I'll send you an invoice. [FACT: payment method]
The winter cohort starts January 11
Applying is free, takes about five minutes and doesn't create an account.