JavaScript for Real Applications
Modern JavaScript for engineers who ship: ES2020+ syntax, async that doesn't bite back, modules, npm hygiene, and the JS bugs that actually get exploited.
Learn
Courses & learning tracks
Structured security training for the SudoSecurity community — open lessons for everyone, deeper tracks for members.
Learning paths
Backend Engineer
From first HTTP handler to services that stay up: APIs, data, concurrency and deploys.
5 courses
Homelab Admin
Run your own box like a professional: hardening, containers, networking and observability.
5 courses
Security Practitioner
Offense-informed defense: crypto, web vulns, detection and incident response.
5 courses
Frontend Developer
The browser as a platform: semantic HTML, modern CSS and production JavaScript.
3 courses
DevOps & Platform
Ship safely and repeatedly: Git discipline, pipelines, IaC and orchestration.
5 courses
AI Application Developer
Build on LLMs like they are infrastructure: prompts, RAG, tools and evals.
2 courses
PHP Backend Engineering
Modern PHP 8.x backend craft without the framework crutch: FPM, Composer discipline, PDO, sessions, uploads, object injection, and shipping hardened, fast PHP.
Python for Security Engineers
Write real security tooling in Python: parse logs and feeds, drive subprocesses and HTTP safely, avoid deserialization traps, and ship CLIs that survive cron.
Linux Systems Administration
Run Linux servers like an operator: systemd units that restart right, storage that survives reboots, firewalls that actually filter, and a calm first hour of an incident.
Programming: From Working Code to Good Code
Working code compiles; good code survives contact. Data modeling, error handling, testing, debugging, and review — the craft under every language.
Java: Enterprise Foundations That Last
Modern Java for real systems: the JVM mental model, concurrency from thread pools to virtual threads, DI without magic, and the deserialization risks that still burn enterprises.
Applied Cryptography for Engineers
Hash, encrypt, sign, and manage keys like a builder — the primitives production systems actually use, and the misuse patterns that quietly break them.
Cybersecurity Fundamentals for Practitioners
Think like an operator: threat-model your systems, walk the attack lifecycle, harden and instrument hosts, and run your first incident — with real commands and real pitfalls.
Docker & Containers in Production
Dockerfiles that build fast and stay small, images that run as nobody, and the runtime flags, secret handling, and hygiene that keep a container from becoming your incident report.
Networking for Engineers Who Touch Real Systems
The mental model of production networking: TCP/IP, DNS, TLS handshakes, NAT and proxies, and how to prove where a connection died with ss, tcpdump, and curl.
SQL & Databases for Builders
Schema design that survives refactors, index strategy that survives scale, and transactions that don't corrupt data at 3 a.m. Postgres-flavored SQL for people who ship.
C for Systems & Security
Read and write C where it still lives: memory ownership, pointer arithmetic, undefined behavior, the classic exploit patterns, and the modern tooling that catches them.
Rust for Production Services
Rust the way real services need it: ownership and lifetimes without fear, trait-driven design, thiserror/anyhow, async with Tokio, workspaces, and auditing unsafe.
Git in Practice
The git a working engineer actually uses: history as a tool, rebase vs merge with judgment, bisect for regression hunts, reflog for recovery, hooks, and signed commits for supply-chain trust.
Web Application Security in Practice
The OWASP landscape from the defender's bench: XSS, CSRF, SSRF, injection, broken auth, and deserialization — exploit, fix, and the headers that hold.
Shell Scripting That Doesn't Bite
Write Bash you can hand to a teammate: strict mode, quoting, arrays, xargs, traps, temp files, cron vs systemd timers, and the failure modes that delete production.
Kubernetes for Real Workloads
Run Kubernetes the way operators do: pods and deployments that survive node failures, requests and limits that hold under pressure, probes, rollbacks, RBAC, network policies, and the failure modes that page you at 3am.
Go for Production Services
Go as it earns its keep on a real service: package layout, error discipline, goroutines that don't leak, net/http with actual timeouts, context, table-driven tests, and pprof when things get slow.
TypeScript in Practice
Structural typing, narrowing, discriminated unions, generics that earn their keep, strict tsconfig, and honest types at untrusted boundaries — TypeScript past the tutorial.
Incident Response & Digital Forensics
Respond like a professional: triage and scope intrusions, preserve evidence, work memory and disk forensics, build the timeline, contain and eradicate, and write the postmortem that prevents the next breach.
Detection Engineering
Build detections that fire on attackers, not noise: the telemetry that matters, Sigma-style rule craft, ATT&CK mapping that stays honest, false-positive tuning, atomic tests, and real coverage metrics.
AWS Cloud Security
Secure AWS the way breaches actually happen: IAM policy anatomy and privilege escalation, S3 and network exposure, CloudTrail/GuardDuty detection, and the day-one hardening baseline.
API Design & Security
Build APIs that survive real users and real attackers — resource modeling, versioning, scoped tokens, boundary validation, rate limiting, and the OWASP API Top 10.
Linux Internals for Engineers
What the kernel actually does for you: processes, scheduling, memory, the VFS, namespaces and cgroups, and the strace/perf workflow for explaining why your service behaves the way it does.
Web Development from First Principles
Build web pages the way experienced front-end engineers do: semantic HTML that carries meaning, CSS layout that doesn't fight you, responsive design that starts mobile-first, and accessibility that ships in the first draft.
Python Engineering: Idioms, Packaging, and Production
Python the way senior engineers write it: iterators and the data model that make code feel idiomatic, packaging and testing that let a project grow past one file, and the typing, debugging, and error-handling habits of production Python.
Software Engineering Practice: Code That Lasts
The habits that separate shipping code from engineering software: tests as a design tool, debugging as a process not a panic, refactoring in safe steps, and code review that actually makes code better.
Backend Engineering with Node & Bun
How real servers work: the event loop that makes Node fast, HTTP and routing without framework magic, middleware and validation, session and token auth, and the resilience and performance habits of production APIs.
LLM Application Engineering
Build software on top of language models like an engineer, not a demo: prompting as an interface, structured output, RAG that retrieves the right thing, tools and agents with boundaries, evals, and the cost math that decides whether it ships.
Minecraft Plugin Development with Paper
Write Paper plugins like a server owner who ships: the lifecycle, events, commands, schedulers, config, persistence, and the performance rules that keep a 100-player server at 20 TPS.
Self-Hosting: Run Your Own Services Like an Operator
From a fresh VPS to services that survive reboots and attacks: hardening, nginx, TLS, Docker Compose, backups that actually restore, and updates that don't take your Saturday.
Observability: Seeing Production Clearly
Logs, metrics, and traces the way operators use them — Prometheus and Grafana without the wallboard theater, alerting that doesn't cry wolf, and SLOs that turn 'it feels slow' into an engineering decision.
CI/CD: Pipelines That Earn Trust
Continuous integration and delivery the way senior teams run it: fast feedback loops, test gates that mean something, cached builds, deployment strategies, and rollbacks that aren't a plan-B panic.
Infrastructure as Code with Terraform
Declare infrastructure, don't click it — Terraform's resource model, state as the source of truth, plan/apply discipline, modules, and remote state that lets a team share one reality.
React Engineering
React the way production teams use it — hooks discipline, state architecture, data fetching, performance, and the component patterns that survive contact with real requirements.
PostgreSQL in Practice
Postgres the way it behaves in production — MVCC and the WAL, indexes that actually get used, EXPLAIN fluency, transactions that don't corrupt data, and the operational habits that keep a database boring.
Testing Engineering
Tests that earn their keep — the pyramid done right, doubles without over-mocking, integration and e2e that don't flake, and the CI discipline that keeps the suite trustworthy.
System Design in Practice
How real systems scale — from one server to many, caches and queues and load balancers, the failure modes that matter, and the trade-off vocabulary senior engineers use to argue about architecture.
Algorithms & Data Structures in Practice
The data structures and algorithms that actually show up in real engineering — hash maps, trees, graphs, dynamic programming — with complexity reasoning you can apply to your own code, not just interview problems.
Terminal & Tooling Mastery
The command-line fluency that separates fast engineers from everyone else — shells, pipes, text tools, ssh, tmux, dotfiles, and building a workflow that makes you faster every week.