Also, I should check if there's any educational value here. If they're learning software development, guiding them to ethical hacking resources or security research could be a good redirection.