🛡 Secure · 19 capabilities you can learn between now and November
Nothing you own fails on its own.
Secure is the verb for keeping yourself, your people and your work out of harm. It is the practice of making one bad afternoon stay one bad afternoon: recovery that survives losing the device, a call you break off and ring back, a network you can name every machine on. 11 classes teach it between now and November.
Free, on this school, right now
- Digital Identity Defense
- Aug 26
- Automate Your Email: No Code AI Automation
- Sep 4
- Agentic SDLC
- Sep 7
- Critical Thinking and Creativity with AI
- Sep 11
- Context Engineering
- Sep 16
- Production Agent Engineering
- Sep 17
- Practical Propaganda
- Sep 19
- AI Alignment
- Sep 25
- Home Network Defense
- Sep 30
- Consumer Device Rescue and Defense
- Oct 28
- Scam and Fraud Home Defense
- Nov 25
Every one of these can be taken on its own, pay what you can, and none of them needs another. Take the one that matches the thing you are worried about.
The devices you already own.
A phone, a laptop or the router that is already in your house, and an evening you can sit with it. No terminal, no command line, nothing to buy and nothing to install before you arrive. You bring your own inbox and your own accounts because those are the ones you are going to change.
The dependency chain
The phone is gone. Walk what goes with it.
Security advice is a list until it is a chain. Five questions about your own setup, thirty seconds, and the chain gets drawn as yours: which links hold, which snap, and what is left standing at the far end. Each break names the class that closes it.
- 01 · given The phone Left in a taxi, taken off a table, does not matter which. Lost
- held the second factor
- 02 Your second factor The codes, the prompt, the thing that proves it is you. ?
- guards the email
- 03 Your email Not a mailbox. A key ring. ?
- recovers everything else
- 04 Everything it recovers Bank, domain, cloud, the group chat your family trusts. ?
- and then the money
- 05 · far end The account your customers pay through The one you would have to ring people about. ?
Answer these about your own setup. With scripting off you get the whole list at once, with every remedy under it — the same information, in a less theatrical order.
-
Question 1 · the second factor
Was the only copy of your second factor on the phone that just went? Authenticator app with no export, push prompts to that handset, codes you never printed.
Digital Identity Defense $100 · Aug 26configure recovery that survives losing the device
What you have to showRecovery codes printed and stored off any device, a password manager on every device, SMS removed as a recovery method, and a written account of what happens if the phone is gone.
-
Question 2 · the number
Can a text message to that number still reset the password on your main email? Check rather than guess. Most people who say no have an old fallback switched on.
Digital Identity Defense $100 · Aug 26configure recovery that survives losing the device
What you have to showRecovery codes printed and stored off any device, a password manager on every device, SMS removed as a recovery method, and a written account of what happens if the phone is gone.
-
Question 3 · the phone call
Somebody rings claiming to be your carrier, confirming the replacement SIM. Does your household have a way to check that does not involve trusting the caller? A number you ring back on. A code phrase. Anything that is not the caller's own word.
Scam and Fraud Home Defense $100 · Nov 25operate a callback rule against incoming contact
What you have to showA household agreement in writing including a code phrase, and one real incoming contact you broke off and called back.
-
Question 4 · the blast radius
Could you name every device on your home network right now, without looking? The phone knew your wifi. So does the handset you handed down, and the tablet in the kitchen.
Home Network Defense $100 · Sep 30locate every device on your own network
What you have to showA device inventory taken from the router, with each entry identified or explicitly listed as unidentified.
Consumer Device Rescue and Defense $100 · Oct 28follow a device hardening checklist
What you have to showThe router or device admin pages before and after — default password changed, remote administration off, automatic updates on — with one line per item on what it closes.
-
Question 5 · the one that settles it
Have you ever tried to take over your own accounts from the outside — the recovery flow, the help desk, the lot? Every answer above is a claim about a system you have not tested. This is the question that turns them into evidence.
Digital Identity Defense $100 · Aug 26falsify your own account recovery by attempting it
What you have to showA written attempt log against your own accounts, the furthest step reached, and the control you added because of it.
Trace log · every answer prints here, including the questions your earlier answers make pointless. Nothing is sent anywhere; the walk runs in this tab and is forgotten when you close it.
Want to start tonight, for nothing? The Digital Security Reset guide walks the same ground in an evening, free.
Free and public
Five guides, for five specific bad nights.
Each one was written for somebody typing a single question into a search bar at 2am. Free, no account, no email address. Read the one that is yours.
Got hacked by hackers?
Somebody is in your accounts. The Digital Security Reset is the order to do things in when everything feels urgent at once — what to change first, what to check next, and what to stop touching.
Read the reset → Free guideCyberstalked by an ex or a partner?
Six Roses is for the case where the adversary knows your birthday, your mother's name and which café you work from. Written for somebody who is still in the situation, not somebody looking back on it.
Read Six Roses → Free guideActivist?
If your threat model is the state, here is the guide you want. This is not an easy path: it changes how you carry a phone, how you plan a thing, and who is told what, before anything happens rather than after.
Read the activist guide → Free guideJournalist?
Protecting a source is a different problem from protecting yourself: the leak can come out of your draft, your metadata or your travel. This is the working practice, for reporters and the people who edit them.
Read the journalist guide → Free guideHome for the holidays?
You are the one relative who knows computers, and you have a weekend. This is what to fix on your family's phones, router and accounts while you are there, in the order that buys the most safety per hour.
Read the holiday guide →On the calendar
Four home defense classes, in an order that is argued.
Your network, then the devices on it, then the people who ring them, then the accounts those people are after. Take all four or take the one you need. You leave each evening with a thing that exists: a device inventory, a hardened router, a household code phrase, a printed recovery kit.
Home Network Defense
$100- follow a device hardening checklist
- locate every device on your own network
- produce a threat model for your own situation
- design a household security posture for people who did not choose it
- reconcile security with what people will actually do
Consumer Device Rescue and Defense
$100- follow a device hardening checklist
- locate a substitute part when the named one is unavailable
- repurpose a retired device into a working server
- migrate your work off a subscription without losing it
- design a household security posture for people who did not choose it
Scam and Fraud Home Defense
$100- operate a callback rule against incoming contact
- produce a threat model for your own situation
- transform an incoming message into ask deadline and claimed sender
- classify an incoming contact as genuine or pretext
- design a household security posture for people who did not choose it
- reconcile security with what people will actually do
Digital Identity Defense
$100- configure recovery that survives losing the device
- operate a callback rule against incoming contact
- classify an incoming contact as genuine or pretext
- falsify your own account recovery by attempting it
- verify what can be found about you is actually gone
- design a household security posture for people who did not choose it
- reconcile security with what people will actually do
Also on the calendar
Secure work inside classes that are about something else.
An AI class that teaches you where untrusted input enters a system, and an off-grid automation class that teaches you to run a mesh network with the internet down. They are about their own subjects, and they are on the calendar too.
Automate Your Email: No Code AI Automation
$200- transform an incoming message into ask deadline and claimed sender
Agentic SDLC
$500- produce a list of where untrusted input enters a system
- characterise an applications injection surface
Critical Thinking and Creativity with AI
$100- configure an assistants memory and outside connections
Context Engineering
$400- produce a refusal boundary that fires on cases you did not list
Production Agent Engineering
$200- justify a safety case for a system that acts without you
Practical Propaganda
$100- verify separate identities do not leak into each other
AI Alignment
$300- characterise how an ai assisted attack unfolded
- justify a safety case for a system that acts without you
- select among operating boundaries for inputs a system was not built for
What is in the box
A live room, a thing you build, and the material to keep.
sessions on the calendar between August and November, pay what you can. You bring your own router, your own inbox and your own accounts, and you change them in the room while somebody is there to ask.
capabilities you can learn from these classes, and every one of them names the artifact you have to produce before it counts — a printed set of recovery codes, a device inventory, an attempt log against your own accounts. They are printed on this page, below, before you pay for anything.
exercises across these 11 classes, plus 114.7 hours of recording and the reference material each class ships with — the Six Roses handbook for the household classes, a working companion for the AI ones. Yours after, not just during.
The work itself
What you can walk out able to do, and what proves it.
Written as verbs, easiest first, each one dated and each one with the artifact that settles it printed underneath. Read them before you decide whether an evening is worth its own price.
-
Sep 30next taught
follow a device hardening checklist
Consumer Device Rescue and Defense Oct 28 · Home Network Defense Sep 30
The router or device admin pages before and after — default password changed, remote administration off, automatic updates on — with one line per item on what it closes.
-
Sep 30next taught
locate every device on your own network
Home Network Defense
A device inventory taken from the router, with each entry identified or explicitly listed as unidentified.
-
Sep 11next taught
configure an assistants memory and outside connections
Critical Thinking and Creativity with AI
Memory on with one fact it retained across a fresh conversation, one connector enabled with the scopes it was granted written out, and one source you deliberately did not connect with the reason.
-
Aug 26next taught
configure recovery that survives losing the device
Digital Identity Defense
Recovery codes printed and stored off any device, a password manager on every device, SMS removed as a recovery method, and a written account of what happens if the phone is gone.
-
Aug 26next taught
operate a callback rule against incoming contact
Digital Identity Defense Aug 26 · Scam and Fraud Home Defense Nov 25
A household agreement in writing including a code phrase, and one real incoming contact you broke off and called back.
-
Sep 7next taught
produce a list of where untrusted input enters a system
Agentic SDLC
An enumerated list against a real codebase or system, including one entry point that is not an obvious form field.
-
Sep 16next taught
produce a refusal boundary that fires on cases you did not list
Context Engineering
Three declines on cases absent from the boundary text, three accepts on near neighbours you did want, and the near miss that made you rewrite it.
-
Sep 30next taught
produce a threat model for your own situation
Home Network Defense Sep 30 · Scam and Fraud Home Defense Nov 25
Your own tier model, naming the adversary and capability at each tier, with the specific practice each tier changes.
-
Sep 4next taught
transform an incoming message into ask deadline and claimed sender
Automate Your Email: No Code AI Automation Sep 4 · Scam and Fraud Home Defense Nov 25
Three real messages from your own inbox split into the three parts, with the ask restated in your own words and the deadline named as invented or genuine.
-
Sep 7next taught
characterise an applications injection surface
Agentic SDLC
A written surface map for a real application naming the query, template or shell interpreter behind each entry point.
-
Sep 25next taught
characterise how an ai assisted attack unfolded
AI Alignment
One documented incident traced end to end, with the model's contribution distinguished from what conventional tooling could already do.
-
Aug 26next taught
classify an incoming contact as genuine or pretext
Digital Identity Defense Aug 26 · Scam and Fraud Home Defense Nov 25
Five real examples classified with the tell named for each, including one genuine message that looked like a pretext.
-
Aug 26next taught
falsify your own account recovery by attempting it
Digital Identity Defense
A written attempt log against your own accounts, the furthest step reached, and the control you added because of it.
-
Sep 17next taught
justify a safety case for a system that acts without you
Production Agent Engineering Sep 17 · AI Alignment Sep 25
A written safety case for one autonomous system, with its falsifying condition stated and the evidence that would settle it.
-
Sep 19next taught
verify separate identities do not leak into each other
Practical Propaganda
The compartments with what may cross between them, and a self-audit that found at least one crossing you had not intended.
-
Aug 26next taught
verify what can be found about you is actually gone
Digital Identity Defense
The before-and-after search record, the brokers contacted, and the items that did not come down with what you did instead.
-
Aug 26next taught
design a household security posture for people who did not choose it
Consumer Device Rescue and Defense Oct 28 · Digital Identity Defense Aug 26 · Home Network Defense Sep 30 · Scam and Fraud Home Defense Nov 25
A posture in place across at least three people who did not set it up, and one protection that held when someone did the wrong thing anyway.
-
Aug 26next taught
reconcile security with what people will actually do
Digital Identity Defense Aug 26 · Home Network Defense Sep 30 · Scam and Fraud Home Defense Nov 25
A requirement people were bypassing, the revised version they follow, and evidence the revision still closes the original threat.
-
Sep 25next taught
select among operating boundaries for inputs a system was not built for
AI Alignment
Scores across a deliberate shift in the inputs, the point at which they fall, and the operating boundary you wrote from it.
One evening, in detail
You have to read a pretext before you can write one.
Ring your own provider. Run your own recovery flow. Answer the security questions as a stranger would and find out how far that stranger gets before somebody stops them. Almost nobody has done this to themselves, and everybody has an opinion about how it would go.
Doing it means pretexting yourself — inventing a plausible story, in a plausible voice, and watching which part of it the help desk believes. So you learn to read one first: five real messages, the tell named in each, including the genuine one that looked like a trap. Both halves happen in the same room on the same evening, and you leave with the log of what you got away with.
Digital Identity Defense
$100- classify an incoming contact as genuine or pretext
- falsify your own account recovery by attempting it
What you have to showA written attempt log against your own accounts, the furthest step reached, and the control you added because of it.
Where else it turns up
Most people who need this did not come here for security.
They came to build something, run something or hold a group together, and the security work arrived attached to it. These are the routes where that happens.
A solo founder is the company's single point of failure. “configure recovery that survives losing the device” is filed under security, but for one person carrying a business it is business continuity: the difference between a bad afternoon and telling your customers why nobody can bill them.
People who build things that provoke draw attention they did not plan for. A project that gets noticed brings an audience you did not choose. That is a threat model arriving after the fact, which is the worst time to write one.
Disqualifiers
Who should not buy this.
- Anyone in immediate danger. If somebody is in your accounts right now, or you are being followed, a course schedule is the wrong speed. Read the guides above tonight and ring the people whose job that is.
- Anyone who wants to break into things. This is defense, start to finish. Every capability here is about a system you are responsible for, and the proof is that it held.
- Anyone who wants a credential rather than a practice. Nothing here awards a badge. What you leave with is a device inventory, a household rule, a printed recovery kit and a log of your own attack on yourself.
- Anyone who wants to watch. These are working rooms. You bring your own router, your own inbox and your own family, and you change them while somebody is there to ask.
Or take all of them
What a month buys, if one evening is not the shape of it.
One class needs nothing else. Two monthly subscriptions cover the whole school instead, and they are different products.
Start anywhere
Read one guide tonight. Book one class this month.
The guides cost nothing and need no account. A class can be taken on its own, pay what you can, and needs no other class. If you want every Secure class rather than one evening of them, the Defender path is the door for that.