Security
Don’t Take the Bait
A plain-English guide to spotting phishing emails, scam texts, and fraud calls, written for people who are not technically confident. It opens with a dramatised terminal showing an attack succeeding, then takes apart a fake bank email, a fake delivery text, and a support-call script — click any flag in a message to read exactly why it gives the game away. An eight-question quiz follows, and three of the eight are genuine on purpose, because teaching people to suspect everything just makes them ignore real fraud alerts.
There is also a one-page checklist built to be printed and stuck on a fridge, for the person in your life who will never read a website.
No account No tracking Works without JavaScript PrintableOpen the guide
CTF Flashcards
A capture-the-flag trainer built around active recall. You solve a CTF puzzle to unlock its flashcards, then the deck schedules itself with FSRS spaced repetition so the material comes back exactly when you are about to forget it. An AI Learn tutor will teach any security topic from scratch and then lock its practice challenges until you have actually reviewed the cards.
Aimed at anyone working through picoCTF-style challenges who keeps re-learning the same techniques because nothing stuck the first time.
FSRS scheduling AI tutor Web + mobileOpen the trainer How it was built
IDOR Lockbox
A deliberately broken notes app, built to be broken. Sign in with the test account it hands you and you get your own private notes plus a box that opens a note by number. The number is the whole lesson: the app checks that you are logged in, but never checks that the note you asked for is yours. That is an Insecure Direct Object Reference, and it is one of the most common real-world web flaws there is.
Nothing here is a trick question and there is no setup — open it, poke at the number, and watch an access-control bug happen to you rather than reading about one.
This lab is mine and is meant to be attacked. Practice on it, on deliberately vulnerable targets, or on systems you have written permission to test — never on anyone else’s.
IDOR Access control No setupOpen the lab
Learning & Study
DiverseLearning
AI-generated interactive courses for learners who think differently. Every concept is rendered as a 3D model you can rotate, pull apart, and inspect piece by piece, instead of a wall of text about it.
Interactive 3D Generated coursesOpen DiverseLearning How it was built
Villages
Small study cohorts, matched by AI. Students and adult learners get grouped with people working on the same thing, with voice and text discussion, collaborative challenges, and an AI “Village Elder” on hand when the group gets stuck.
Study cohorts Voice + textOpen Villages
Study Tools
Physics and maths calculators, solvers, and a flashcard system that run as real Python in your browser through PyScript — no install, no runtime to set up. Useful if you want to see the working rather than just an answer.
Python in-browser PyScriptOpen the study tools
Reading
Elsewhere on this site
- All projects — everything above plus the work that is not teaching-shaped.
- Cybersecurity Lab — the offensive and defensive security work these tools came out of.
- About and Contact — who made these, and how to reach me.
Back to top