The next cyber generation: what a 16-year-old learns from CTFs and bug bounty

At 16, I am a high school student in Kenitra, and I devote part of my free time to cybersecurity. At first, it was mainly curiosity: understanding how websites and applications work, and how they can be better protected. Over time, that curiosity led me to CTF competitions and vulnerability research within authorized programs.

The first lesson I learned was not about a tool: before testing a system, you need to know whether you are allowed to do so, and within what limits. In cybersecurity, curiosity is useful when it is combined with method and responsibility.

Learning in an environment designed for testing

CTF, or “Capture The Flag,” competitions offer challenges designed for training. Participants analyze files, programs or simulated scenarios in order to find a solution. The environment is intended to be tested. You can try, make mistakes, reread clues and compare your reasoning with that of your team.

I take part in competitions with CYBERDUNE CLUB, a student team whose public CTFtime profile presents its CTF activities and results.1 Working with other participants teaches me to explain an idea, listen to another approach and verify a conclusion. A good answer is not only one that works: you need to understand why it works.

A real system is different from a training challenge. A page that is accessible on the Internet is not automatically an authorized target. Even with positive intentions, testing without permission can expose data, disrupt a service or fall outside the legal framework. For me, the boundary between practice and responsible research begins with clear authorization.

What an organized program changes

A bug bounty or vulnerability disclosure program specifies the systems concerned, the tests that are permitted and how to submit a report. Researchers need to read those rules before starting and follow them. A reward is never guaranteed: it depends on the program criteria and the assessment of the report.

I recently reported to Upfort, through Federacy, a vulnerability that the company classified as critical. After its assessment, I received a reward. I cannot publish the technical details, which must remain confidential. I described this experience in an earlier guest article published by UnderNews; I can also provide the editorial team, on request, with supporting evidence redacted to remove personal and sensitive information.2

This experience mainly showed me that finding a problem is only one part of the work. A report must clearly describe what was observed, under what conditions and with what limitations, without exaggerating the impact. It should enable the organization to understand the problem and correct it, while avoiding access to other people’s data or any action that could disrupt the service.

Coordinated disclosure relies on this collaboration between researchers and organizations. In the United States, CISA requires the relevant federal civilian executive branch agencies to publish a vulnerability disclosure policy and establish a process for receiving reports.3 This approach shows how a clear reporting channel and understandable rules can help both sides address a security issue.

Progress is built over time

Being a high school student also means finding a balance between classes, training and rest. I continue learning through exercises, training resources and competitions, without pretending to have mastered everything. When a challenge resists, going back to the basics or asking a teammate for their view is part of the work.

I would like more young people in Morocco to be able to discover cybersecurity in accessible and legal settings: clubs, workshops, competitions and training environments. You do not need to know everything before you start. You can progress step by step, learn to document your results and, above all, respect the rules before interacting with a real system.

My journey is still taking shape. This reward is one step, not proof that I know how to do everything. What I want to continue is serious learning: developing my skills, continuing my studies and contributing to digital security without forgetting that every test concerns services used by real people.

Mohamed Reda Mejhed — redeex
High school student in Kenitra, Morocco

The information relating to the Upfort reward is reported in the first person and can be verified with the author. No confidential technical details are disclosed.