In progressPreps for the PWPA cert
TCM Practical Bug Bounty
TCM Security's practical web pentest course. Methodology, hands-on labs, full attack chains. I'm currently in the reconnaissance section.
Sections
Learning in public · 2 active
AppSec Notes
Public notes from every security course I'm working through.One repo per course. Plain markdown, my own words, dated commits.
Why public
If I think someone might actually read these, I take them more seriously. That's the whole point of doing it in public.
Each commit is a small unit of progress, dated. The trail matters more than any one polished page.
Lab writeups come from authorized environments only: course labs, PortSwigger Academy, HackTheBox, my own homelab. Never client work, never embargoed bug bounty findings.
Courses I'm working through
One repo per course. Section chips link straight to that folder on GitHub.
Cert roadmap
Course notes feed into cert prep. As I get closer to each exam I'll spin up a dedicated prep repo so the commit history stays focused.
- In progressTCM Practical Bug Bounty (PBB) — course in progress
- In progressPortSwigger Web Academy — Apprentice level, in progress
- NextTCM PWPA exam
- NextPortSwigger BSCP exam
- LaterOffSec OSWE
Also on this site
- Security Labs. Hands-on writeups from SANS Cyber Academy with real captures and full methodology.
- llm-audit. Open-source Semgrep rule pack for OWASP LLM Top 10 in TypeScript.
- Blog. Long-form posts on security tooling and what I've shipped.