Warning
Season 3 is historical learning material. Season 4 is temporarily unavailable.
Both seasons were calibrated against one specific AI model that every player shared. That fixed baseline is no longer available on equal terms across all account types, and newer models respond differently to the same prompts. Several of the original solutions no longer produce the expected result.
Season 4 is paused while we move it to a new model backend, and play will be restored here when that lands. Season 3 is preserved as a historical artifact; recalibrating it is work we have not scoped.
Both remain readable in the meantime: explore their challenges, source code, hints, and solutions as case studies in AI security. For hands-on play right now, start with Season 1 or Season 2.
Learn to code securely while having fun through our popular open source in-editor experience, designed for developers, students, and anyone curious about security. Get started with Season 1 or 2 for free in under 2 minutes, playing right from your browser. Over 10,000 players across industry and academia have already played. Visit gh.io/scg for testimonials and FAQs, and feel free to open a contribution to help make the game better for everyone.
For hands-on secure coding, choose Season 1 or 2. For AI security, Season 3 remains readable as a historical case study, and Season 4 while it is paused, covering LLM defenses, Agentic Workflows, and Multi-Agent Communications. Their original challenge instructions remain available for context, rather than as a promise that the challenges can still be completed today.
| Season | Focus | What you'll learn | Status |
|---|---|---|---|
| Season 4 | Agentic AI | Study security risks in AI agents that execute commands, browse the web, use tools, and coordinate other agents | Temporarily unavailable / read-only |
| Season 3 | LLM Security | Study LLM-powered app defenses through prompt design, input/output handling, and connected data sources | Historical / read-only learning |
| Season | Focus | What you'll learn | Duration |
|---|---|---|---|
| Season 2 | Multi-Stack | Security across CI/CD, backend services, and web apps with CodeQL Uses GitHub Actions, Go, Python, and JavaScript |
~6 hrs |
| Season 1 | Foundations | Secure coding fundamentals covering web apps, systems programming, and data handling Uses Python and C |
~6 hrs |
The setup below is for hands-on play in Season 1 or 2. To read the historical AI material in Season 3 or Season 4, simply browse the files here on GitHub; no Codespace is needed.
Click Use this template at the top of this repository, then select Create a new repository. Choose your personal account or an organization as the owner, and we recommend making it public so that it does not use Actions minutes.
Use GitHub Codespaces for hands-on play in Season 1 or 2. Be aware this will count towards your 60 hours of monthly free allowance.
- In your new repository, click the Code button and select Create codespace on main.
- Wait for extensions and background installations to complete. This takes less than three minutes.
- Pick Season 1 or 2 from the table above, open its folder, and read the
README.mdto begin.
💡 If a banner asks you to create a virtual environment, dismiss it. You don't need one.
Need help? Email us at securitylab-social@github.com, start a thread in GitHub Discussions, or join us on Slack in the #secure-code-game channel.
Get help: Email us at securitylab-social@github.com • Review the GitHub status page
© 2026 GitHub • Code of Conduct • MIT License