Case Study: Code.org strengthens proactive security and continuous testing with Bugcrowd

Code.org surfaces 134 vulnerabilities with Bugcrowd

Code.org, a nonprofit edtech organization, needed to strengthen its security posture to protect the sensitive data of millions of students. While it had internal security checks, these measures were not sufficient to uncover complex, interconnected vulnerabilities that external attackers might exploit. The infrastructure engineering team, busy with triage, lacked the capacity for deep, proactive security testing. They turned to Bugcrowd to move beyond periodic penetration tests.

By implementing a private Managed Bug Bounty program with Bugcrowd, Code.org gained continuous security testing from a global researcher community. Bugcrowd's managed triage service identified critical vulnerabilities without burdening the internal team, providing the data needed to justify hiring a dedicated security engineer. The results were significant: 134 vulnerabilities rewarded, a shift to always-on testing, and the prevention of potential outages. This partnership helped Code.org build a proactive security culture, ensuring platform reliability for its users.

Code.org