CodeQuestPlay · Think · CodeStaffCODEQUEST AFTER-SCHOOL CLUB · PROPOSAL
A year-long coding club built on CodeQuest, the school's own coding platform. A planned 30 90-minute lessons, each teaching one core idea to the whole club at five levels of depth. A six-year-old and a sixteen-year-old learn the same idea in the same room, each at the right level. Internet safety runs through every session, and it's fun.
Lesson 1's Quest Trial places each pupil on a track. Ages are a guide, not a rule: a confident 9-year-old can be a Challenger, and a 14-year-old who is new to coding can start as a Builder. Pupils move up or across at any time.
Ages 6–9
New to coding, early readers.
Plans and debugs a sequence using Step once, spots repeated patterns, and makes a personalised greeting card web page.
Ages 9–12
Some Scratch or block coding experience.
Writes short Python with for loops, builds a styled multi-section web page, and knows how to spot phishing.
Ages 12–15
Comfortable typing code, or ready to start.
for, if / else, try / except, then sensors and the left-hand rule.Writes a Python program that solves mazes it has never seen, builds an interactive web page, and uses the Linux command line.
Ages 15–18
IB Diploma Computer Science, MYP Design, or keen independent learners.
Ships a portfolio project, can explain common web attacks and how to defend against them, and can mentor younger pupils as club leaders.
Any age
Already code independently, sometimes well beyond their age.
Has built ambitious projects, can teach any core idea at several levels, and leads a stream or CTF Day.
Each lesson is designed to be low floor, high ceiling, wide walls: easy for anyone to start, with no limit on how far a pupil can go, and many different ways to explore. One core idea, said in one sentence, is taught to the whole club during the hook. In build time, each track meets that idea at a different depth. Here's Lesson 6, Loop-de-loop:
Core idea · everyone
"When you see a pattern, a loop lets you say it once and repeat it." Taught through a clap-and-stomp dance loop.
Explorers
Find the pattern in Staircase and say it as "repeat 3 times…"
Builders
Find every repeated section in Staircase and Flag run.
Challengers
Python for loops, then stairs(n) with a parameter.
Seniors
Nested loops: one function for mazes of different sizes.
Trailblazers
Find the shortest possible program, and prove nothing shorter exists.
Progress and the scoreboard: pupils do the lesson challenges on their own student page, signed in to the class. Teachers see who has done what on the Class dashboard, which also has a projector-ready scoreboard with points and 15 achievements for up to 20 pupils.
Every term covers every area, and lessons build on earlier ones. Lessons 1 and 2 are complete; the rest are outlines showing where the year is heading.
From Term 2, Challengers, Seniors and Trailblazers can choose a focus stream. Keen Builders can join by invitation. Everyone still shares each lesson's core idea, so the club stays together and every pupil keeps a broad base.
Stream
Python lab lessons, sensors and free coding on every maze.
A solver that beats every mission; a maze generator designed on paper and coded in Python.
DP Computer Science (computational thinking, algorithms); MYP Personal Project.
Stream
Web Lab Levels 1 and 2, five templates, live preview and download.
A site for a school club, charity drive or event, or a portfolio of club work.
MYP Design cycle (inquire, develop, create, evaluate); MYP Personal Project.
Stream
The Cyber tab, with links to OverTheWire Bandit and OWASP Juice Shop.
An online safety campaign for younger year groups; a security review of club web pages.
DP Computer Science; CAS service through teaching online safety.
Stream Planned
The maze commands and sensors. The Hardware tab is coming soon, and until then the Wokwi simulator works with no kit.
A weather station, a night light, or a robot that drives a taped floor maze using the same commands as CodeQuest.
MYP Design; DP Computer Science; CAS creativity.
A capture-the-flag (CTF) competition run at school: a hacking game where teams solve security challenges to find secret "flags" and score points. It makes an exciting end-of-year finale for the Cyber stream, and it's open to every track at their own level. It's built on OWASP Juice Shop's CTF support: a fake online shop, deliberately full of security flaws, with challenges from one star (beginner) to six stars (expert).
Explorers & Builders
An unplugged or browser-based trail: secret codes (Caesar ciphers), "spot the phish" cards, hidden clues in a web page's source, and a password-strength sorting game. Each answer is a flag.
Challengers
Find the hidden score board, trigger error messages, spot information leaks, and try basic cross-site scripting (XSS). Optionally, a "fix-it" round using the Snack Shack bug hunt.
Seniors
SQL injection, broken access control, weak passwords and more. Teams write up how they'd fix each flaw, because defending is the real goal.
Cyber stream
Cyber stream pupils help design the puzzle trail, test challenges beforehand, and run the scoreboard on the day.
| Part | Plan |
|---|---|
| Format | Teams of 2–4, mixed where possible. Around 2–3 hours: an after-school special, or a half-day event. A briefing on the golden rule first, then a live scoreboard on the projector, and prizes and certificates at the end. |
| Scoreboard | The free juice-shop-ctf-cli tool loads Juice Shop's challenges into a CTF scoreboard (CTFd, FBCTF or RootTheBox) in minutes. Teams submit flags there, and hints can cost points. For a small first event, Juice Shop's own built-in score board is enough. |
| Servers | Each team needs its own copy of Juice Shop. Small event: one Docker container per team on a teacher laptop or school server. Larger event: MultiJuicer runs a separate copy for every team automatically, with its own leaderboard. |
| Safety | Juice Shop is deliberately insecure, so it runs only on the school's internal network, never on the open internet. The IT team signs off on the setup. Every pupil agrees to the golden rule: these skills are only ever used on systems you own or have permission to test. |
| Lead-up | Lessons 21–27 (the command line, web security, incident response and AI) prepare every track. CTF Day is Lesson 30. The Cyber stream runs a practice round two weeks before the event. |
| Going further | Winners and keen teams can enter picoCTF, the free international CTF for school students, or invite another school next year. |
All optional, all free. CodeQuest works on any home computer with a modern browser, and progress saves to the pupil's class sign-in. Pupils in a focus stream can also carry on their stream project at home.
CodeQuest is built in-house, so it can grow with the club. These are the next possible steps for each area, based on what exists today.
| Area | Available now | Possible next steps |
|---|---|---|
| Practice Coding | 4 maze worlds and 8 missions, Command builder, stars, badges and class sign-in with cloud saves | More missions; keys, gates and inventory puzzles; a maze editor so pupils can design and share levels; shared class leaderboards with moderated nicknames |
| Python lab | Real Python in the browser, lessons 1–4 (loops, decisions, exceptions, sensors), free coding | Lessons on functions, parameters and while loops; test one program against several mazes; a line-by-line Python debugger |
| Poem Art | Drag-and-drop blocks and Python to style a poem | A poem library across ages and languages; sound and animation effects; share to a class gallery |
| Web Lab | Level 1 drag-and-drop cards; Level 2 HTML/CSS/JS editor with five templates, live preview and download | More Level 1 cards; a class gallery of published pages; teacher-set briefs; a Level 3 multi-page site |
| Cyber | Topic outline, plus links to OverTheWire Bandit and OWASP Juice Shop | A built-in "spot the phish" quiz; log-reading incident response scenarios; a password-strength explorer; a guided route through Bandit |
| Hardware | Coming soon | ESP32 with MicroPython guides; wiring diagrams; sensor builds that echo the maze sensors (wall_ahead() → a distance sensor); a physical robot driven by the same commands |
| AI Future | Future consideration: topic outline and links to free resources (Teachable Machine, Machine Learning for Kids, Experience AI) | How AI learns, using it wisely (bias, checking answers, deepfakes), training classifiers, a maze robot that learns by trial and error, and possibly a fifth focus stream |
| Projects | Example projects for every area and age, from greeting cards to maze robots and CTF teams | Curated beginner-friendly open source projects; guided build-from-scratch projects; a showcase of club work |
| Teachers | Class sign-in and saved progress | A teacher dashboard showing each pupil's progress by track; assigning missions; printable task cards and certificates |
One laptop or Chromebook per pupil, or one between two for pair programming. Tablets work for Explorers. Chrome or Edge. A projector for the whole-group spark.
One teacher for up to around 20 pupils, plus Senior helpers. No specialist software or admin rights are needed.
The site must be reachable on the school network. The first Python run downloads about 12 MB once, so it's worth opening it before the club starts.
Pupils join through a class link using a nickname and a six-digit PIN from their teacher, with no email address. Code runs in a locked-down browser sandbox. External cyber labs are supervised and pupils are taught the golden rule: only ever test systems you own or have written permission to test.
Optional, for Term 3. ESP32 starter kits (board, LEDs, sensors and leads) cost very little per pair and are reusable year after year.
Stars, badges and saved work in the app; a term showcase; and pupils moving up a track. Leading the club counts towards IB CAS for Diploma students, and projects can feed into MYP Design and the MYP Personal Project.