You will find a problem in something you do not own, and how you handle it matters more than the problem. This set covers reporting privately, a reasonable window, finding a security contact, and the difference between publishing an exploit and a write-up after a fix.
Each one is marked as you go, and the explanation arrives straight after, which is
the part worth reading.
4 questions, marked as you go.
Tasks
These need your own device. Run the command in Termux, then paste what it printed.
The marking looks at what the output means, so spacing, version numbers and
ordering do not matter. If you have not installed anything yet, the
lesson covers the setup.
Keep a disclosure record
When you report a problem, keep a record of what you did and when. This writes a short disclosure record and reads it back. The contact line names where the security contact was found, and the window line records the time you agreed to give before any write-up.
Run this in Termux
On your own device. Nothing on this page executes it. The command runs in
your terminal, and this box only reads what you paste back.
mkdir -p ~/disclosure; printf "vendor: example project, example.org\ncontact: security@example.org, listed in /.well-known/security.txt\nreported: 2026-10-25, privately by email\nwindow: 90 days from the report before any write-up\nstatus: reported and awaiting a reply\n" > ~/disclosure/record.txt; cat ~/disclosure/record.txt
Five lines: the vendor, the contact, when you reported, the window, and the status.
the record names the security contact
it records when the report was made
it notes the disclosure window or its status
the commands actually ran
What a good answer looks like
Five lines recording the vendor, the security contact and where it was found, the date you reported, the disclosure window, and the current status. With these lines you can reconstruct the whole sequence later: when you reported, to whom, how you found them, and where things stand. Keeping the record is how a single report becomes a habit you can point at.
Marking your own work
Both halves of this are checked in your browser, with no server involved, so nothing
stops you from pasting output you did not run. The tasks are written so that the
easiest way to pass one is to actually do it and read the result, which is the whole
intention.