CodeAI

Description

Program temporarily paused Effective August 1 at 12:00am Pacific Time, the CodeAI bug bounty program is temporarily paused while we work through our current submission and remediation backlog and reassess how the program should operate. The engagement is not accepting new bounty submissions during the pause. Reports submitted before the pause took effect will continue to be reviewed under the program terms that applied when they were submitted. We do not yet have a date for resuming the program. We will post an update if and when bounty submissions reopen. Urgent security concerns may still be reported through [email protected], but reports submitted while the program is paused are not eligible for monetary rewards. NOTICE: Backlog reports submitted before the pause will be reviewed for technical validity; due to a funding pause, they are not eligible for monetary rewards. PAUSED PROGRAM BRIEF: Welcome to the CodeAI Bug Bounty Program At CodeAI®, our mission is to give every student access to a world-class computer science education. We appreciate your time and expertise in helping us safeguard that mission. By reporting security issues here, you’re supporting millions of learners—and ensuring student data stays protected. Basic Rules & Best Practices Keep Findings Confidential: Please disclose vulnerabilities only through this platform. Please do not release without our consent. Be Considerate of the Environment: Use your @bugcrowdninja.com email for test accounts, and steer clear of any testing that might affect legitimate user data or other researchers’ work. For more info regarding @bugcrowdninja email addresses, see here . Respect Rate Limits: We appreciate your thoroughness, but please avoid overwhelming our systems or performing Denial-of-Service attacks—our test environment is modest. Stay Within Scope: If you discover something on a domain not explicitly listed, we still welcome the report, but it may not qualify for a bounty if it’s marked out-of-scope. Open Source & Accessibility Our application code is largely open source , so you can dig into our GitHub repository for deeper insight. We also host a publicly accessible target environment , which means you’re free to sign up as different role types (student, teacher, admin, etc.) using your bugcrowdninja.com address. Just remember: no real PII beyond what’s necessary for test accounts, please. CodeAI User Types Students – Minimal PII (hashed email, first name), can join teacher sections and create/share projects. Teachers – Self-chosen by the user at account creation; manage sections, assign work, and set simplified logins for kids. Teachers have limited access to control the log in options for students that have joined their class (section) Verified Teacher – A teacher marked “verified” by an admin; can bypass throttling; access content not generally available Facilitators/Regional Partners – Oversee teacher PD courses but don’t handle student credentials. Admins – CodeAI staff with elevated privileges (must have @code.org email); can assume user identities for support. To minimize sensitive data, we don’t store last names or emails for students. Account Creation & Login Methods Email & Password – Straightforward sign-in (students’ emails are hashed). Single Sign-On (SSO/OAuth) – Google, Microsoft, Facebook, Clever, etc.; accounts can link multiple providers. Teacher-Created Accounts – Teachers provide a 6-letter section code (no personal email required). Simple Logins – Picture choice or two-word phrase for younger students. Federation (External Tools) – Automatic creation/login via Google Classroom, Schoology, LTI, etc. We recommend you make separate “teacher” and “student” logins using [username][email protected] and [username][email protected] Things that Users Own Student Coding Projects We offer various “Labs” tailored for different programming experiences. Students can create projects using labs like these: Block-Based Labs (Sprite Lab, Flappy, Minecraft, Frozen, Dance Party): Intro to coding via drag-and-drop blocks. App Lab and Game Lab : More advanced, allowing JavaScript coding and game creation. Web Lab : Lets students build and host HTML/CSS projects. 🎉 Python Lab : Our new lab type, executing Python in the web browser. Java Lab , AI Lab , and Others: Specialized experiences for Java, AI experiments, and a variety of legacy labs. Students should be the only ones allowed to edit their project. However, most labs are automatically shared, if someone knows the link. Our share functions only make it easier to share the existing public link. Visitors see a read-only version of the project and can “remix”. Curriculum Curriculum can be accessed in one of two ways: Teachers assign curriculum to students (and when the student logs in, they are immediately taken there ) Students can directly browse the Course Catalog Curriculum “levels” are units of educational content that behave similarly to Projects. They save the student’s work, but these do not have the sharing functions that projects do. There are various other variations in the curriculum level experience, to instruct and measure progress

Targets

Target Platform Caveats Our Target environment varies from our Production Environment in the following known aspects: WebLab: there is no way to see the visiting-user view (codeprojects.org) Federated Logins: you cannot log in via Google, Microsoft, Facebook, Clever or any LTI paths Course Catalog: Some links go direct to production (see workaround in this video ) The environment will go down for 15-25 minutes each time it updates to the new version (auto-updates when we deploy to production). We don't have the same graceful autoscaler and deploy mechanism that we do in production, so restarting the target environment's web server is a necessary step today. Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through this program, or inquire via [email protected] before going any further.