GitHub Secure Code Game: Season 4 Puts You Inside an AI Agent

What the Secure Code Game actually is, and who it is for

The Secure Code Game is a set of security exercises published under the skills organisation on GitHub. The README describes it as an open source in-editor experience for developers, students, and anyone curious about security, and states that it can be started in under two minutes from a browser. It is not a library you import. It is a template repository you copy, then open in a Codespace, then work through season by season.

The audience is broader than the phrase security training usually implies. The README says no AI or coding experience is needed for Seasons 3 and 4, and it states that over 10,000 players across industry and academia have already played. Seasons 1 and 2 are aimed at people who do write code: Season 1 uses Python and C, Season 2 uses GitHub Actions, Go, Python, and JavaScript with CodeQL. If your job involves reviewing pull requests, the Season 2 material is the closest to daily work.

How the seasons are structured and what Season 4 adds

The repository is organised as four top-level directories, Season-1 through Season-4, each with its own README. The README states that each season is self-contained, so you can start at Season 3 or Season 4 without completing the earlier ones. That is a deliberate design choice: it trades a linear curriculum for lower entry friction.

The durations are listed per season. Season 1 and Season 2 are each about six hours. Season 3 is about 1.5 hours, and Season 4 is about two hours. The newer seasons are shorter and narrower, which matches their subject matter. Season 3 covers LLM security through prompt design, input and output handling, and connected data sources. Season 4, the current one, has you work inside an interactive AI coding assistant that the README says turns natural language into bash commands, browses the web, connects to live data sources, runs org-approved skills, stores persistent memory, and orchestrates multi-agent workflows. Five progressively harder levels cover Agentic Workflows and Multi-Agent Communications.

The honest reading of that description: Season 4 is a simulation of a tool surface, not a production agent you deploy. The security lessons come from the failure modes the exercises expose, so the value depends on how much the simulated tool surface resembles what your team actually runs.

Installing it: template copy, Codespace, first season

There is no package to install. The README gives a two-step path. First, click Use this template at the top of the repository, then select Create a new repository. The README recommends making the copy public so that it does not consume Actions minutes.

Second, open a Codespace in your new repository. The README notes this counts towards the 60 hours of monthly free allowance. The Code button offers Create codespace on main, and extensions plus background installations finish in under three minutes according to the README.

# Nothing to run to install the course itself.
# The Codespace postCreateCommand installs the Python dependencies
# listed in requirements.txt automatically.
cat requirements.txt

That file is short and worth reading before you start. It lists pyOpenSSL, bcrypt, flask, flask-testing, blinker, and requests, with a comment stating they are for Seasons 1 and 2 and are installed by the Codespace postCreateCommand in .devcontainer/devcontainer.json. If you plan to run Season 1 or Season 2 exercises outside a Codespace, that file is your dependency list.

Once the Codespace is ready, the README says to pick a season folder and read its README.md. It also gives one practical instruction: if a banner asks you to create a virtual environment, dismiss it, because you do not need one. That detail matters, since a virtual environment would hide the dependencies the postCreateCommand already installed.

The Codespaces allowance is the real cost of entry

The game is free, and the README says so directly. The compute is not unlimited. Every session runs in a GitHub Codespace, and the README states plainly that opening one will count towards your 60 hours of monthly free allowance. Season 1 and Season 2 are listed at roughly six hours each. A learner who works through both plus Season 3 and Season 4 is looking at around 15.5 hours of listed duration, and that figure excludes idle time, rebuilds, and the minutes a Codespace keeps running while you read.

For an individual on a personal account, that is comfortable. For a team running a workshop on shared accounts, the arithmetic changes quickly, and the README does not document any bulk or organisational provisioning path. It points to email, GitHub Discussions, and a Slack channel for help, which suggests the maintainers expect individual learners rather than cohort administrators. The README also does not document rollback or reset behaviour if you break an exercise environment, so plan on deleting and recreating the Codespace if something goes wrong.

Where it fits against Secure Code Warrior and other training

The obvious comparison is Secure Code Warrior, which appears in the related searches for this project. The two solve overlapping problems with different mechanics. Secure Code Warrior is a commercial platform: organisations buy seats, and the vendor supplies dashboards, assessments, and reporting that a security or compliance function can point at. The Secure Code Game is an MIT-licensed GitHub template. There is no seat, no dashboard, and no completion record beyond your own repository and its commit history.

That difference decides the use case. If you need to demonstrate to an auditor that forty engineers completed secure coding training in a given quarter, the Secure Code Game does not give you that artifact, and the README does not claim to. If you want an engineer to spend two hours understanding why an AI agent that turns natural language into bash commands is dangerous, the template route costs nothing and starts in a browser. The trade is reporting and structure for cost and immediacy.

Licence and the cost of keeping a copy current

The repository is MIT licensed, and the README footer links to the MIT licence text. That is permissive: you can fork it, modify the exercises, and use it inside a company without a commercial agreement. The README does not add terms on top of MIT, and it does not state any restriction on using the material for internal training. It does ask that contributions go through CONTRIBUTING.md, which is a convention for upstreaming fixes rather than a licence condition. This is a description of what the repository states, not legal advice; if your organisation has rules about copying external repositories, check them separately.

Upgrade cost is low but not zero. There are no retrieved releases, so there is no versioned artifact to track. Updates arrive as commits to the default branch, and the last push was on 2026-09-13. If you forked the template, your copy does not receive those commits automatically. Refreshing means either syncing from upstream or creating a new repository from the template and redoing any local exercise edits. That is the maintenance model: cheap to adopt, manual to keep in step.

What the repository does not tell you

Several things a buyer would want are absent. The README does not document rollback or a reset command for a broken exercise. It does not describe completion tracking, scoring, or certificates. It does not list prerequisites beyond the note that Seasons 3 and 4 need no AI or coding experience, and it does not explain how the five Season 4 levels are validated. There is no retrieved release history, so there is no changelog to read before adopting.

The repository layout is the best signal available about scope: four season directories, a devcontainer, a requirements.txt, a CONTRIBUTING.md, and a LICENSE. Nothing else. That is a small surface, which is consistent with a course rather than a platform. Treat the absence of assessment tooling as a design boundary, not a gap the project intends to close.

Editorial conclusion

Adopt the Secure Code Game if you want a zero-install security exercise set that runs in a browser and you already have a GitHub account: the template click plus a Codespace is the whole setup. Skip it if you need graded, auditable training records or a fixed multi-day syllabus, because the repository ships exercises and a README per season, not assessment tooling. Before committing a team, verify the Codespaces hour cost against your allowance, confirm which season maps to your stack by reading Season-1/ through Season-4/, and check whether your organisation permits a public copy of the template repository.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. Project website
4. README
5. skills/secure-code-game on GitHub