Before the club app launches, review it like a security team: inspect its accounts, its data and its system, choose the fix that really closes each weakness, and collect a flag for each section you make safe. Everything from the course comes together: unique passphrases and MFA, collecting only what is needed, hashed passwords, a real privacy notice, HTTPS and updates.
The club app launches tomorrow. Seven weaknesses are hiding in it. Find and fix them all.
Your mission: the club app launches tomorrow. Review it the way a security team reviews its own systems: inspect every part, choose fixes that really close each weakness, and collect a flag for each section you make safe. Each flag looks like WP{…}.
Engage: Commit to a prediction before you test anything. A wrong guess is fine: it shows you what to look for.
Explore: Try it on the board and compare what happens with your prediction.
Explain: Put a name to what you saw, and why it works.
Elaborate: Use the idea in a new situation.
Evaluate: Look back at your first ideas and what changed.
Make your prediction first. Help opens once you've locked it in.
EngageCommit to a prediction before you test anything. A wrong guess is fine: it shows you what to look for.
Engage: why review it yourself?
ExploreTry it on the board and compare what happens with your prediction.
Explore: the review
Was your prediction right?
Try it yourselfYour edits are saved in this browser.
Inspect every part of the club app and fix all seven weaknesses.
Use the board. This ticks when you get there.
ExplainPut a name to what you saw, and why it works.
Explain: the flags
Worked exampleBefore each step, say what you think comes next.
AccountsUser weaknesses: reused passwords and no second factor. Fix: unique passphrases and MFA.
DataPrivacy and storage: unneeded fields, passwords as typed, no notice. Fix: collect less, hash, tell people.
SystemTravelling and supply chain: no HTTPS, an old add-on. Fix: HTTPS and updates from the real source.
wrong fixesEach wrong option sounds helpful but leaves the weakness open: ask what it actually stops.
Flag 1: the Accounts section, once both its weaknesses are fixed, shows a flag. Type it.
Flag 2: the Data section's flag. Type it.
Flag 3: the System section's flag. Type it.
ElaborateUse the idea in a new situation.
Elaborate: launch day
Try it yourselfYour edits are saved in this browser.
Need a hint?
For each weakness, ask what each fix actually stops.
Another hint
A fix that only sounds careful (rename, hide, ask nicely) leaves the weakness open.
The launch-day copy has the same seven weaknesses. Fix every one, choosing the right fix first time.
Use the board. This ticks when you get there.
EvaluateLook back at your first ideas and what changed.
Evaluate: look back
For teachers
The course finale. Students review the fictional club app's accounts, data and system, choose the fix that really closes each of seven weaknesses (wrong fixes explain why they fall short), collect three flags, then repeat on the launch-day copy with every fix right first time (AC9TDI10P13 node 1, AC9TDI10P14 node 3). Defensive throughout. A 5E mission lesson. About 40 minutes.
I can review a system's accounts, data and setup for weaknesses.
I can choose a fix that really closes a weakness, and say why others don't.
I can protect stored passwords with hashing and collect only what's needed.
Before class
Try the board yourself. The club app is made up.
Flags (for you, not students): Accounts WP{unique-and-mfa}, Data WP{only-what-we-need}, System WP{patched-and-encrypted}. Each appears on the board when its section is fully fixed, so the flags reward the fixing; they aren't puzzles.
The one idea: a review checks every part of a system and picks fixes by what they actually stop.
Years 7–8 classes can do this lesson after the first unit: the Data and System sections then lean on your explanation of hashing and HTTPS.
Extension: picoCTF (Carnegie Mellon) has free CTF practice for school students; check its account and age requirements, and your school's policy, before recommending it.
Running the lesson
Engage: ask what a security team is for.
Explore: ask which wrong fix sounded most convincing, and why it falls short.
Explain: ask which lesson of the course each flag comes from.
Elaborate: ask students to say the reason for each fix aloud before clicking.
Evaluate: discuss what should happen each time the app gets a new feature.
The hard part (on purpose)
Students click fixes until one works. The launch-day copy needs every fix right first time, so the reasoning matters.
When students get stuck
A student picks 'Add a ! to the end of it'. Ask: If the old password leaked, what would someone try first? Fix: Small changes to a leaked password are first on the list: use a unique passphrase.
A student picks hashing to fix the missing HTTPS. Ask: Is the password travelling or stored at this point? Fix: HTTPS on the way, hashing in storage.
Stretch and support
Stretch: Add one new feature to the club app (events sign-up, say) and write its threat model and privacy notice.
Support: The course's idea cards beside the board: passwords, MFA, footprint, threat model, kinds of weakness, APPs.
Where it leads
End of the course. The Security and privacy course (Years 9–10) goes deeper into how sign-in, hashing and keys work, and has its own capture the flag.
What each step is for
Engage: why review it yourself?: Committing to why a team reviews its own system frames the finale: find and fix weaknesses before launch, defensively.
Explore: the review: Students apply every lesson of the course to one system, and the wrong fixes explain why they fall short.
Explain: the flags: Each flag marks a section made safe; the explain for each names the course idea behind it.
Elaborate: launch day: The same review with no second tries: every fix must be right first time, showing the course's ideas are secure.
Now you can
Review a system's accounts, data and setup for weaknesses.
Choose a fix that really closes a weakness, and say why others don't.
Protect stored passwords with hashing and collect only what's needed.