Boyolali Primary School Student Finds Security Flaw on NASA Website

A sixth-grade student from Kemusu District, Boyolali Regency, Central Java, has successfully identified a bug or security vulnerability in a public domain system belonging to the United States space agency, NASA. Ibrahim Al Abrar, a 12-year-old pupil at SDN 3 Gedengsari, received a letter of appreciation from NASA dated 9 July 2026. The boy, known as Ibra, previously discovered and reported the security vulnerability to NASA’s Vulnerability Disclosure Policy (VDP). After the report was verified, the agency sent the letter as a token of appreciation for his efforts in detecting the vulnerability and helping to improve their system security. “Alhamdulillah, I am happy,” Ibra said. He explained that he enjoys and studies cybersecurity, a field also taught by his father, Aminudin, who is a Computer and Network Engineering teacher at SMKN Kemusu. Ibra said he managed to find the security flaw after learning about cybersecurity and being inspired by news of others who had found vulnerabilities in NASA’s systems. After several submissions, his finding was finally verified, earning him a certificate of appreciation. Initially, like most children, he only played games on his mobile phone. He then progressed to learning how to create his own games before his interest expanded into cybersecurity. “I got advice on cybersecurity from older friends online,” he added. Ibra admitted he faced difficulties while learning information technology, particularly when he did not understand the material, so he occasionally relied on YouTube tutorials and artificial intelligence applications. His father, Aminudin, also expressed his happiness, noting that his son initially learned coding and only became interested in cybersecurity in early 2026. “He got the NASA certificate by searching for vulnerabilities on the NASA website. He found a broken link hijacking and reported it through the VDP. He actually submitted the report almost two months ago, but only received the certificate on 9 July,” Aminudin said. He hopes Ibra will become more enthusiastic about learning and that his achievement will motivate other children interested in IT, especially since learning has become easier with advances in information technology. According to NASA’s official website, the VDP is a programme that allows the public to find external vulnerabilities. NASA acknowledges that external vulnerabilities can be discovered by anyone at any time and has issued the policy to provide clear guidelines for security researchers to comfortably report vulnerabilities they have found in good faith. For validated findings, NASA issues a letter of appreciation or recognition, though not all submissions qualify. Reports marked as duplicates or identified as known issues are not eligible for a Letter of Recognition, which is exclusively granted for validated, accepted, and confirmed P1-P4 rated reports.