| CARVIEW |
Select Language
HTTP/2 301
date: Thu, 25 Dec 2025 08:18:14 GMT
content-type: text/html
location: https://owasp.org/www-project-hack-heroes/
cf-ray: 9b36e816cdf0ccbb-BLR
cf-cache-status: DYNAMIC
accept-ranges: bytes
age: 0
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 varnish
content-security-policy: default-src 'self' https://*.fontawesome.com https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com https://buttons.github.io; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://viewer.diagrams.net https://fonts.googleapis.com https://*.fontawesome.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' https://*.fontawesome.com fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org https://render.com https://*.render.com https://okteto.com https://*.okteto.com data: www.w3.org https://*.bestpractices.dev https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com https://static.scarf.sh
permissions-policy: geolocation=(self)
referrer-policy: same-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-cache: MISS
x-cache-hits: 0
x-fastly-request-id: 2048e171c382292fa34bf9af26afbea921db0db9
x-github-request-id: E3AA:1387E:3E3C25:44E3FF:694CF345
x-served-by: cache-bom-vanm7210066-BOM
x-timer: S1766650694.268805,VS0,VE205
HTTP/2 200
date: Thu, 25 Dec 2025 08:18:14 GMT
content-type: text/html; charset=utf-8
cf-ray: 9b36e8186853ccbb-BLR
cf-cache-status: DYNAMIC
access-control-allow-origin: *
age: 0
cache-control: max-age=600
expires: Thu, 25 Dec 2025 08:28:14 GMT
last-modified: Wed, 13 Aug 2025 13:58:50 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 varnish
content-security-policy: default-src 'self' https://*.fontawesome.com https://api.github.com https://*.githubusercontent.com https://*.google-analytics.com https://owaspadmin.azurewebsites.net https://*.twimg.com https://platform.twitter.com https://www.youtube.com https://*.doubleclick.net; frame-ancestors 'self'; frame-src https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.sched.com https://*.google.com https://*.twitter.com https://www.youtube.com https://w.soundcloud.com https://buttons.github.io; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://viewer.diagrams.net https://fonts.googleapis.com https://*.fontawesome.com https://app.diagrams.net https://cdnjs.cloudflare.com https://cse.google.com https://*.vuejs.org https://*.stripe.com https://*.wufoo.com https://*.youtube.com https://*.meetup.com https://*.sched.com https://*.google-analytics.com https://unpkg.com https://buttons.github.io https://www.google.com https://*.gstatic.com https://*.twitter.com https://*.twimg.com https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://*.gstatic.com https://cdnjs.cloudflare.com https://www.google.com https://fonts.googleapis.com https://platform.twitter.com https://*.twimg.com data:; font-src 'self' https://*.fontawesome.com fonts.gstatic.com; manifest-src 'self' https://pay.google.com; img-src 'self' https://*.globalappsec.org https://render.com https://*.render.com https://okteto.com https://*.okteto.com data: www.w3.org https://*.bestpractices.dev https://licensebuttons.net https://img.shields.io https://*.twitter.com https://github.githubassets.com https://*.twimg.com https://platform.twitter.com https://*.githubusercontent.com https://*.vercel.app https://*.cloudfront.net https://*.coreinfrastructure.org https://*.securityknowledgeframework.org https://badges.gitter.im https://travis-ci.org https://api.travis-ci.org https://s3.amazonaws.com https://snyk.io https://coveralls.io https://requires.io https://github.com https://*.googleapis.com https://*.google.com https://*.gstatic.com https://static.scarf.sh
permissions-policy: geolocation=(self)
referrer-policy: same-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-cache: MISS
x-cache-hits: 0
x-fastly-request-id: 7b36b0fd10f64f55cd42da5774cb435b134151f7
x-github-request-id: 8A97:3655F2:3F0DCF:45B5B6:694CF343
x-proxy-cache: MISS
x-served-by: cache-bom-vanm7210066-BOM
x-timer: S1766650695.512645,VS0,VE212
content-encoding: gzip
OWASP Hack Heroes | OWASP Foundation
This website uses cookies to analyze our traffic and only share that information with our analytics partners.
Acceptx
OWASP Hack Heroes
OWASP Hack Heroes 🦸 is an open-source project created to inspire young people to explore careers in 🛡️ cybersecurity. It features a series of in-browser challenges aimed at ages 8-14, but is fun for all ages.
- Try it now: hackhero.es
- Source Code: GitHub - hackheroes
Key Features
- Engaging Spy-Themed Cybersecurity Challenges: Solve missions that teach technical concepts in a fun, interactive way.
- Interactive Learning: Each challenge provides hints, objectives, and tools to help players learn and complete tasks.
- Customisable Toolset: Gadgets include an HTML Reader/Editor, JavaScript Console, Decoders, and more to help users complete their missions.
- Browser-Based: All game logic executes in the user’s browser, making it easy to host and great for privacy and security.
- Local Data Storage: Game progress is stored locally in the browser, not on servers, ensuring privacy and security.
- Alpine.js-Powered: Application logic is built using Alpine.js.
- Modern UI: Uses Bulma for responsive design and Ace Editor for code editing.
- Tested with BrowserStack: Ensures cross-browser compatibility.
Technology Stack
- HTML, JavaScript, CSS
- Alpine.js for dynamic content and interaction
- Bulma for modern, responsive design
- Ace Editor for in-browser code editing
- LocalStorage for saving player progress
Road Map
Currently there are 6 challenges, 5 ‘gadgets’ for solving challenges, and a simple presentation layer. Future plans include:
- Authoring more challenges aligned with early computer science learning objectives.
- Piloting in schools and gathering feedback.
- Creating a knowledgebase for deeper learning.
- Considering server-based support for leaderboards and progress saving.
- Expanding challenge sets for different ages and difficulty levels.
Data & Privacy
Hack Heroes stores anonymous challenge status data in your browser. No personal information is required or stored on servers.
For more details, visit the main website or the GitHub repository.
The OWASP® Foundation works to improve the security of software through its community-led open source software projects,
hundreds of chapters worldwide, tens of thousands of members, and by hosting local and global conferences.
Hack Heroes Information
- Live Platform @ hackhero.es
- Source Code on GitHub
- Incubator Project
- Version: Pre-Release
- Builder
- Breaker