A second season of the GitHub Secure Code Game
GitHub has released the second season of its Secure Code Game, bringing five new challenges contributed by the community. The challenges cover JavaScript, Python, Go, and GitHub Actions. Since the game’s launch in March 2023, more than 3,500 developers have played. Four of the five new challenges were contributed by members of the community.
The game remains simple to start: review code, fix vulnerabilities, and run tests to move to the next level. Players can spin up a fully configured environment in the cloud using GitHub Codespaces in under two minutes, with up to 60 hours per month available for free. The game targets developers and students who want to improve their code security skills, integrate security into their workflows, and learn how to use GitHub Advanced Security (GHAS).
From feedback to game design
The original motivation for the game came from common complaints about existing secure coding training. Community members reported boring, purely theoretical courses, often video-based; learning outside of a development environment; assessments via multiple-choice questions that don’t reflect the real-world difficulty of fixing security issues without introducing new ones; and a lack of personalization based on the languages and frameworks they use, including security issues that arise from one’s coding style.
To address these, GitHub opted for a gamified, in-repo experience that works both in Codespaces and locally, keeping developers in their code editor. Each level challenges players to spot the security issue(s), fix them, and keep the code’s existing functionality intact to progress. This threefold challenge mirrors the real-world difficulty of remediating an issue effectively without regressions. The open source nature of the game also invited contributions from the community.
Contributing to the Secure Code Game means having an impact in the wider security world through open source. I added challenges to the second season inspired by real-life scenarios, to help others learn in an engaging, fun, and hands-on way.
Real-world adoption
Feedback from the community highlights the game’s practical impact. A PropTech startup ran its first hackathon based on the Secure Code Game after unsuccessful attempts with other training methods. The company turned common security issues it faced into new challenges and had engineers compete in teams of two. By combining GHAS and the Secure Code Game, the startup saw a 96% reduction in security issues and nearly a 97% reduction in weekly time the security team spent helping developers with remediation.
Our engineers had fun! We noticed an increased sense of ownership among developers and willingness to learn directly from our security engineers.
The game has also made its way into academia. At the University of Novi Sad, instructors used it for interactive lectures with active student participation.
I observed that this is a more efficient way to share knowledge compared to the classic delivery with a passive audience. Students immediately got a chance to practice concepts and learn by doing. They also realized that security shouldn’t be an afterthought because they experienced in practice when it’s bolted on top of a feature-rich application, it’s just too late and risky.
Play and contribute
Developers can start playing the second season now. Those interested in shaping the future of the game can review the contribution guideline on GitHub to submit ideas. The game is available at gh.io/securecodegame.
