Secure Code Game
Learn to code securely while having fun through our popular open source in-editor experience, designed for developers, students, and anyone curious about security. Get started for free in under 2 minutes, playing right from your browser.
Last verified:
What is Secure Code Game?
The Secure Code Game is an in-repo learning experience created by GitHub Security Lab where players fix intentionally vulnerable code to build a secure coding mindset while having fun. Launched in March 2023, the game challenges players to review code, spot security issues, fix them, and run tests to progress to the next level without introducing regressions. The game is designed for developers and students who want to improve their code security skills, learn how to build security into workflows, and understand how to use GitHub Advanced Security (GHAS).
The game features multiple seasons with challenges across different programming languages including JavaScript, Python, Go, C, and GitHub Actions. Season 4, titled
Secure Code Game pricing
Pricing model: Freemium
The Secure Code Game is completely free and open source to play. It runs in GitHub Codespaces which provides up to 60 hours of free usage per month for all users. There are no paid plans, subscription tiers, or premium features. The game is distributed via a GitHub template repository and all challenges, seasons, and content are available at no cost. GitHub Security Lab maintains the game as a public benefit initiative.
Secure Code Game pros
- Free and open source to play
- Runs in GitHub Codespaces in under 2 minutes
- Includes up to 60 hours of free monthly usage on Codespaces
- Hands-on practical training instead of theoretical courses
- Developer-first approach keeping developers in their code editor
- Multiple programming languages covered: JavaScript, Python, Go, C, GitHub Actions
- Community-contributed challenges from security experts
- Season 4 focuses on emerging agentic AI security vulnerabilities
- 5 progressive levels per season with increasing difficulty
- No previous AI experience required for Season 4
- Can be run locally or in cloud Codespaces environment
- Includes pre-written tests to validate fixes
- Open source allows community contribution to new levels
- Recognized with 96% reduction in security issues at one startup
- Used successfully in university classrooms for interactive lectures
- GitHub Security Lab initiative with official backing
- Over 10,000 developers have played prior seasons
- 2.6k stars on GitHub showing strong community adoption
- Includes hint files and solution files for learning
- Gamified approach makes security training engaging and fun
Secure Code Game cons
- Only provides 60 hours free Codespaces usage per month
- Assumes beginner or intermediate coding knowledge to start
- Text-based content may not suit visual learners
- No mobile app or mobile-friendly interface
- Requires GitHub account to access and play
- Limited to specific programming languages per season
- Later levels require CodeQL knowledge for hints
- Season 4 has no dedicated AI prerequisites but may be challenging for non-AI developers
- Community contributions require approval process before merging
- No official certification or completion credential
- Primarily focused on finding/fixing rather than prevention strategy
- May require troubleshooting for local setup without Codespaces
- No built-in leaderboard or competitive ranking system
- Limited real-world enterprise scenario variety beyond сезо́нов
- No instructor-led support or live mentorship available
Frequently asked questions about Secure Code Game
What is the Secure Code Game?
The Secure Code Game is an in-repo learning experience created by GitHub Security Lab where players fix intentionally vulnerable code. The game is designed to help developers build a secure coding mindset while having fun. Players review code, spot security issues, fix them, and run tests to progress to the next level.
Is the Secure Code Game free to play?
Yes, the Secure Code Game is open source and free to play. It runs in GitHub Codespaces which provides up to 60 hours of free usage per month. There are no paid plans or subscription fees required to access any content.
How do I start playing the Secure Code Game?
Getting started takes under 2 minutes in 2 steps: 1) Clone the template repository, and 2) Open it on Codespaces. The game spins up as a fully configured environment in the cloud via GitHub Codespaces in less than two minutes.
What programming languages are covered in the game?
The game includes challenges in JavaScript, Python, Go, C, and GitHub Actions. Season 2 added five community-contributed challenges in JavaScript, Python, Go, and GitHub Actions. Different seasons focus on different languages and vulnerability types.
Can I contribute new challenges to the game?
Yes, contributions are welcome. You can submit new challenge ideas through GitHub Discussions by providing a vulnerability type, programming language, and scenario description. Once your proposal receives approval, you can submit a pull request following the existing file structure conventions.
What skill level is required to play?
The game assumes a beginner or intermediate level of coding knowledge. The levels become more difficult to complete as the game progresses. No previous AI experience is required for Season 4, making it accessible to all developers.
How does the gamification work?
The game presents intentionally vulnerable code and asks players to find and fix the problem. Players can assess their fix by running the code to ensure it still functions correctly but safely. When pre-written vulnerabilities can no longer be exploited, players advance to the next level.
Has the game been used in enterprises or education?
Yes, over 3,500 developers have played since launch. A PropTech startup used it for hackathons and saw a 96% reduction in security issues. The University of Novi Sad used it in classrooms for delivering interactive lectures with active student participation.
What tools are recommended for playing?
We recommend using GitHub Codespaces for the cloud-based experience, though the game can also be run locally. For later stages of the game, using an application security testing tool like CodeQL is recommended to find vulnerabilities and receive helpful hints on where problems are and how to fix them.