Boyolali Primary School Student Finds Security Flaw on NASA Website

A sixth-grade primary school pupil from Kemusu Subdistrict, Boyolali Regency, Central Java, has successfully discovered a bug or security vulnerability in a public system or domain of the United States space agency NASA.

Quoting detikJateng, the pupil from SDN 3 Gedengsari, Ibrahim Al Abrar (12), received an appreciation letter from NASA dated 9 July 2026.

The boy, known as Ibra, had earlier discovered and reported the security vulnerability to NASA’s Vulnerability Disclosure Policy (VDP). After the report was verified, NASA sent a letter as a token of appreciation for his efforts in detecting the vulnerability and helping to improve the security of its systems.

“Alhamdulillah, I’m happy,” said Ibra on Friday (17/7), as quoted by detikJateng.

He said he was fond of and had been learning cybersecurity, in addition to the fact that his father, Aminudin, is a Computer and Network Engineering (TKJ) teacher at SMKN Kemusu.

Ibra said he managed to find the NASA security vulnerability after learning about cybersecurity.

He was also inspired by news reports of people who had successfully discovered security vulnerabilities in NASA’s systems. After several submissions, Ibra’s finding was finally verified and he received the appreciation letter from NASA.

“The appreciation came in the form of a certificate,” Ibra explained.

Like most children, Ibra initially only played games on his mobile phone. He then progressed to learning how to create games himself.

His ambitions grew further and he began learning cybersecurity.

“I got into cybersecurity on the advice of older friends online,” he added.

Ibra did not deny having difficulties while learning information technology, one of which was not yet understanding the material. As a result, he sometimes learned through YouTube tutorials or artificial intelligence (AI) applications.

Ibra’s father, Aminudin, also expressed his delight. His son initially learned coding, and only became interested in cybersecurity in early 2026.

“He received the NASA certificate because he looked for vulnerabilities on NASA’s website. He found broken link hijacking, then reported it through the VDP. The report had actually been submitted for almost two months, but it was only answered on 9 July with the certificate,” said Aminudin.

Aminudin hopes Ibra will become even more enthusiastic about learning. He also hopes that what Ibra has achieved will motivate other children who are interested in IT, as learning has become easier with advances in information technology.

Quoting NASA’s official website, the VDP is the agency’s programme to open up space for the public to externally discover vulnerabilities.

“NASA recognises that external vulnerabilities can be found by anyone at any time, and has issued this policy to provide clear guidelines to security researchers so that they feel comfortable reporting vulnerabilities they have discovered in good faith,” the website stated, accessed by CNNindonesia.com on Friday (17/7) evening.

For security vulnerabilities reported by independent researchers, NASA stated that it will issue a letter of appreciation or recognition.

However, “Not all submitted reports are eligible to receive a Letter of Recognition (LOR).”

“Reports marked as duplicates or identified as known issues are not eligible for an LOR,” the website stated.

“LORs are given exclusively for reports rated P1-P4 that have been validated, accepted, and confirmed to have been remediated,” it continued.