🛡 Secure · 10 capabilities you can learn between now and November
Nothing you own fails on its own.
Secure is the verb for keeping yourself, your people and your work out of harm. It is the practice of making one bad afternoon stay one bad afternoon: recovery that survives losing the device, a call you break off and ring back, a network you can name every machine on. 7 classes teach it between now and November.
Free, on this school, right now
- Solarpunk Automation
- Aug 22
- Digital Identity Defense
- Aug 26
- Agentic SDLC
- Sep 7
- Critical Thinking and Creativity with AI
- Sep 11
- Home Network Defense
- Sep 30
- Consumer Device Rescue and Defense
- Oct 28
- Scam and Fraud Home Defense
- Nov 25
Every one of these can be taken on its own, pay what you can, and none of them needs another. Take the one that matches the thing you are worried about.
The devices you already own.
A phone, a laptop or the router that is already in your house, and an evening you can sit with it. No terminal, no command line, nothing to buy and nothing to install before you arrive. You bring your own inbox and your own accounts because those are the ones you are going to change.
The dependency chain
The phone is gone. Walk what goes with it.
Security advice is a list until it is a chain. Five questions about your own setup, thirty seconds, and the chain gets drawn as yours: which links hold, which snap, and what is left standing at the far end. Each break names the class that closes it.
- 01 · given The phone Left in a taxi, taken off a table, does not matter which. Lost
- held the second factor
- 02 Your second factor The codes, the prompt, the thing that proves it is you. ?
- guards the email
- 03 Your email Not a mailbox. A key ring. ?
- recovers everything else
- 04 Everything it recovers Bank, domain, cloud, the group chat your family trusts. ?
- and then the money
- 05 · far end The account your customers pay through The one you would have to ring people about. ?
Answer these about your own setup. With scripting off you get the whole list at once, with every remedy under it — the same information, in a less theatrical order.
-
Question 1 · the second factor
Was the only copy of your second factor on the phone that just went? Authenticator app with no export, push prompts to that handset, codes you never printed.
Digital Identity Defense $100 · Aug 26configure recovery that survives losing the device
What you have to showRecovery codes printed and stored off any device, a password manager on every device, SMS removed as a recovery method, and a written account of what happens if the phone is gone.
-
Question 2 · the number
Can a text message to that number still reset the password on your main email? Check rather than guess. Most people who say no have an old fallback switched on.
Digital Identity Defense $100 · Aug 26configure recovery that survives losing the device
What you have to showRecovery codes printed and stored off any device, a password manager on every device, SMS removed as a recovery method, and a written account of what happens if the phone is gone.
-
Question 3 · the phone call
Somebody rings claiming to be your carrier, confirming the replacement SIM. Does your household have a way to check that does not involve trusting the caller? A number you ring back on. A code phrase. Anything that is not the caller's own word.
Scam and Fraud Home Defense $100 · Nov 25operate a callback rule against incoming contact
What you have to showA household agreement in writing including a code phrase, and one real incoming contact you broke off and called back.
-
Question 4 · the blast radius
Could you name every device on your home network right now, without looking? The phone knew your wifi. So does the handset you handed down, and the tablet in the kitchen.
Home Network Defense $100 · Sep 30locate every device on your own network
What you have to showA device inventory taken from the router, with each entry identified or explicitly listed as unidentified.
Consumer Device Rescue and Defense $100 · Oct 28follow a device hardening checklist
What you have to showThe router or device admin pages before and after — default password changed, remote administration off, automatic updates on — with one line per item on what it closes.
-
Question 5 · the one that settles it
Have you ever tried to take over your own accounts from the outside — the recovery flow, the help desk, the lot? Every answer above is a claim about a system you have not tested. This is the question that turns them into evidence.
Digital Identity Defense $100 · Aug 26falsify your own account recovery by attempting it
What you have to showA written attempt log against your own accounts, the furthest step reached, and the control you added because of it.
Trace log · every answer prints here, including the questions your earlier answers make pointless. Nothing is sent anywhere; the walk runs in this tab and is forgotten when you close it.
Want to start tonight, for nothing? The Digital Security Reset guide walks the same ground in an evening, free.
Free and public
Five guides, for five specific bad nights.
Each one was written for somebody typing a single question into a search bar at 2am. Free, no account, no email address. Read the one that is yours.
Got hacked by hackers?
Somebody is in your accounts. The Digital Security Reset is the order to do things in when everything feels urgent at once — what to change first, what to check next, and what to stop touching.
Read the reset → Free guideCyberstalked by an ex or a partner?
Six Roses is for the case where the adversary knows your birthday, your mother's name and which café you work from. Written for somebody who is still in the situation, not somebody looking back on it.
Read Six Roses → Free guideActivist?
If your threat model is the state, here is the guide you want. This is not an easy path: it changes how you carry a phone, how you plan a thing, and who is told what, before anything happens rather than after.
Read the activist guide → Free guideJournalist?
Protecting a source is a different problem from protecting yourself: the leak can come out of your draft, your metadata or your travel. This is the working practice, for reporters and the people who edit them.
Read the journalist guide → Free guideHome for the holidays?
You are the one relative who knows computers, and you have a weekend. This is what to fix on your family's phones, router and accounts while you are there, in the order that buys the most safety per hour.
Read the holiday guide →On the calendar
Four home defense classes, in an order that is argued.
Your network, then the devices on it, then the people who ring them, then the accounts those people are after. Take all four or take the one you need. You leave each evening with a thing that exists: a device inventory, a hardened router, a household code phrase, a printed recovery kit.
Home Network Defense
$100- locate every device on your own network
Consumer Device Rescue and Defense
$100- follow a device hardening checklist
Scam and Fraud Home Defense
$100- operate a callback rule against incoming contact
- classify an incoming contact as genuine or pretext
Digital Identity Defense
$100- configure recovery that survives losing the device
- falsify your own account recovery by attempting it
- classify an incoming contact as genuine or pretext
- operate a callback rule against incoming contact
Also on the calendar
Secure work inside classes that are about something else.
An AI class that teaches you where untrusted input enters a system, and an off-grid automation class that teaches you to run a mesh network with the internet down. They are about their own subjects, and they are on the calendar too.
Solarpunk Automation
$100- operate a mesh network that carries messages without infrastructure
Agentic SDLC
$500- produce a list of where untrusted input enters a system
- characterise an applications injection surface
Critical Thinking and Creativity with AI
$100- configure an assistants memory and outside connections
What is in the box
A live room, a thing you build, and the material to keep.
sessions on the calendar between August and November, pay what you can. You bring your own router, your own inbox and your own accounts, and you change them in the room while somebody is there to ask.
capabilities you can learn from these classes, and every one of them names the artifact you have to produce before it counts — a printed set of recovery codes, a device inventory, an attempt log against your own accounts. They are printed on this page, below, before you pay for anything.
exercises across these 7 classes, plus 52.8 hours of recording and the reference material each class ships with — the Six Roses handbook for the household classes, a working companion for the AI ones. Yours after, not just during.
The work itself
What you can walk out able to do, and what proves it.
Written as verbs, easiest first, each one dated and each one with the artifact that settles it printed underneath. Read them before you decide whether an evening is worth its own price.
-
Oct 28next taught
follow a device hardening checklist
Consumer Device Rescue and Defense
The router or device admin pages before and after — default password changed, remote administration off, automatic updates on — with one line per item on what it closes.
-
Sep 30next taught
locate every device on your own network
Home Network Defense
A device inventory taken from the router, with each entry identified or explicitly listed as unidentified.
-
Sep 11next taught
configure an assistants memory and outside connections
Critical Thinking and Creativity with AI
Memory on with one fact it retained across a fresh conversation, one connector enabled with the scopes it was granted written out, and one source you deliberately did not connect with the reason.
-
Aug 26next taught
configure recovery that survives losing the device
Digital Identity Defense
Recovery codes printed and stored off any device, a password manager on every device, SMS removed as a recovery method, and a written account of what happens if the phone is gone.
-
Aug 26next taught
operate a callback rule against incoming contact
Scam and Fraud Home Defense Nov 25 · Digital Identity Defense Aug 26
A household agreement in writing including a code phrase, and one real incoming contact you broke off and called back.
-
Aug 22next taught
operate a mesh network that carries messages without infrastructure
Solarpunk Automation
A message delivered node to node with the internet off, reporting the distance covered and the number of hops it took.
-
Sep 7next taught
produce a list of where untrusted input enters a system
Agentic SDLC
An enumerated list against a real codebase or system, including one entry point that is not an obvious form field.
-
Sep 7next taught
characterise an applications injection surface
Agentic SDLC
A written surface map for a real application naming the query, template or shell interpreter behind each entry point.
-
Aug 26next taught
classify an incoming contact as genuine or pretext
Digital Identity Defense Aug 26 · Scam and Fraud Home Defense Nov 25
Five real examples classified with the tell named for each, including one genuine message that looked like a pretext.
-
Aug 26next taught
falsify your own account recovery by attempting it
Digital Identity Defense
A written attempt log against your own accounts, the furthest step reached, and the control you added because of it.
One evening, in detail
You have to read a pretext before you can write one.
Ring your own provider. Run your own recovery flow. Answer the security questions as a stranger would and find out how far that stranger gets before somebody stops them. Almost nobody has done this to themselves, and everybody has an opinion about how it would go.
Doing it means pretexting yourself — inventing a plausible story, in a plausible voice, and watching which part of it the help desk believes. So you learn to read one first: five real messages, the tell named in each, including the genuine one that looked like a trap. Both halves happen in the same room on the same evening, and you leave with the log of what you got away with.
Digital Identity Defense
$100- classify an incoming contact as genuine or pretext
- falsify your own account recovery by attempting it
What you have to showA written attempt log against your own accounts, the furthest step reached, and the control you added because of it.
Where else it turns up
Most people who need this did not come here for security.
They came to build something, run something or hold a group together, and the security work arrived attached to it. These are the routes where that happens.
A solo founder is the company's single point of failure. “configure recovery that survives losing the device” is filed under security, but for one person carrying a business it is business continuity: the difference between a bad afternoon and telling your customers why nobody can bill them.
People who build things that provoke draw attention they did not plan for. A project that gets noticed brings an audience you did not choose. That is a threat model arriving after the fact, which is the worst time to write one.
Disqualifiers
Who should not buy this.
- Anyone in immediate danger. If somebody is in your accounts right now, or you are being followed, a course schedule is the wrong speed. Read the guides above tonight and ring the people whose job that is.
- Anyone who wants to break into things. This is defense, start to finish. Every capability here is about a system you are responsible for, and the proof is that it held.
- Anyone who wants a credential rather than a practice. Nothing here awards a badge. What you leave with is a device inventory, a household rule, a printed recovery kit and a log of your own attack on yourself.
- Anyone who wants to watch. These are working rooms. You bring your own router, your own inbox and your own family, and you change them while somebody is there to ask.
Or take all of them
What a month buys, if one evening is not the shape of it.
One class needs nothing else. Two monthly subscriptions cover the whole school instead, and they are different products.
Start anywhere
Read one guide tonight. Book one class this month.
The guides cost nothing and need no account. A class can be taken on its own, pay what you can, and needs no other class. If you want every Secure class rather than one evening of them, the Defender path is the door for that.