Overview

Hacky Stacky teaches the eight core data structures — arrays, stacks, queues, linked lists, hash tables, trees, graphs, and heaps — by framing each one around the security vulnerabilities it enables, from buffer overflows to use-after-free to hash-collision denial-of-service. Instead of reading about a bug, learners fix real vulnerable Python and have it graded on the spot.

The entire platform runs without a backend. Learner code executes against a hidden test suite directly in the browser, lessons are generated from typed content data, and every page is statically rendered. It's deployed on Vercel with continuous delivery.

It was built as a research project at Washington and Lee University to measure whether interactive, active-recall instruction produces measurable learning gains — so the platform doubles as an IRB-reviewed research instrument, with anonymized, consent-gated telemetry and interactive pre/post assessments woven into each module.

In-browser code execution and grading

The technical centerpiece: there is no server running user code. Hacky Stacky compiles CPython to WebAssembly (via Pyodide) and executes each learner's edited program against a test harness entirely client-side. Submissions are graded in the browser, per-test, with no round trip — the runtime loads once (~10 MB) and is cached thereafter.

This removes an entire class of infrastructure — no sandboxed execution servers, no queueing, no per-request cost — and keeps the platform fully static and horizontally free to scale.

Teaching design

Each module can be read as a single page or played as a three-part guided sequence: the concept, the defensive patterns, and a graded challenge run. Lessons present one idea per screen, pair every operation with its complexity and the reason for it, and require the learner to commit to a prediction before revealing an answer. Challenges unlock sequentially, with progressive hints and an on-demand worked solution for anyone who gets stuck.

Interactive visualizations

More than twenty-five custom, hands-on components let learners manipulate structures directly — pushing and popping a live stack, triggering and then defending a buffer overflow, forcing hash collisions, and walking linked-list pointers. Each is built to make an abstract failure mode concrete.

Progression and gamification

Accounts (email/password) sync a learner's progress across devices. An opt-in leaderboard ranks participants by challenges solved, modules completed, and consecutive-day streak, using self-selected handles so real identities are never exposed.

Research instrumentation

Beyond the product, the platform is a measurement tool. It records structured, fully anonymized learning events under a random identifier, gated behind explicit consent. Every module opens with an interactive pre-test and closes with a parallel post-test — items include predicting program output, clicking the vulnerable line of code, and ordering defensive steps, each captured with response time and a self-rated confidence level. A Python pipeline turns the raw event log into learning-gain and item-difficulty analyses.

Privacy was a design constraint, not an afterthought: no personally identifying information is collected, the database enforces insert-only row-level security so records cannot be read back through the client, and data handling was written to meet human-subjects review requirements.

Tech Stack