Security as a skill, not a chore
Most developers learn to write code that works, then discover—often the hard way—that working code and secure code are not the same thing. A form that accepts user input, for example, is not complete until that input is validated. The gap between functionality and security is a recurring theme in software development, and closing it requires a shift in how developers approach problem solving.
That shift is exactly what the Secure Code Game aims to teach. Created by the GitHub Security Lab team and now available to all GitHub users through GitHub Skills, the game is a hands-on training tool for developers and students who want to strengthen their secure-coding skills. It assumes a beginner to intermediate level of knowledge and increases in difficulty as players advance through levels. Python and C are the first supported languages, chosen for their popularity in open source. Future levels are planned with community contributions in mind.
Why secure coding falls by the wayside
Several factors contribute to the training gap in secure coding. Computer science programs rarely require it, though some institutions encourage it. Many organizations do not place enough emphasis on security training, leaving developers to prioritize features over safety. And the threat landscape changes quickly; keeping up with new vulnerabilities and best practices is a constant effort.
There is also a perception problem. Writing functional code feels productive and creative. Fixing security issues can feel like running in place, especially when the reward is simply avoiding a problem that hasn’t happened yet. But that view misses an important point: code cannot be considered high quality if it is not secure. Security flaws are often found by people who approach code creatively, looking for ways to break it. Developers who want to ship quality software need to learn that same kind of thinking—not to exploit weaknesses, but to prevent them.
Learning by fixing intentionally broken code
The Secure Code Game is built on a simple premise: players are given deliberately vulnerable code and asked to find and fix the flaw. After making a fix, players can run the code to check that it still behaves correctly, then test it against the pre-baked exploits. If the vulnerability no longer works, the level is complete. As the game progresses, challenges get harder, and for later levels the recommendation is to use an application security testing tool like CodeQL to spot vulnerabilities and get hints on where they are and how to resolve them.
The goal is not to achieve perfection on the first try. It is to build awareness—a mindset for reviewing code with security in mind. That skill is what separates code that simply runs from code that runs safely.
The game is available at github.com/skills/secure-code-game. Developers interested in contributing new levels can contact the GitHub Security Lab team directly.
