Defensive security, learned by capturing small flags from toy simulators that run entirely in your browser. Nothing here touches the network or a real system. Every lesson ends with the plain-English fix: what a real engineer changes so the bug can't happen.