Hack Safe
A catalog of legitimate security learning — CTF platforms, OWASP projects, official bug bounty platforms, and student community entry points. Not exploit trading, not “hire a hacker” scams. You can navigate, find Hub (all catalogs), and browse Sister repos.
Disclaimer: Only practice on systems you’re allowed to test. Bug bounties have strict scope rules.
Scams: Fake “cybersecurity internships” and paid “certification guaranteed” → resources/security-scams.md
Pages: student-dev-catalogs · oss-programs-and-hackathons · build-grants · hack-safe · ai-catalog · coding-platforms · public-apis · design-for-devs · cloud-student · maker-student · game-dev-student · never-your-sounds
CTF & practice platforms
| Platform | Best for | Official |
|---|---|---|
| picoCTF | Middle / high school + beginners | picoctf.org |
| CyberPatriot (US) | Student teams | uscyberpatriot.org |
| OverTheWire | Linux / wargames | overthewire.org |
| pwn.college | University-style labs | pwn.college |
| Hack The Box Academy | Structured paths | academy.hackthebox.com |
| TryHackMe | Guided rooms | tryhackme.com |
| CyberDefenders | Blue team challenges | cyberdefenders.org |
| CTFtime | Find live CTF events | ctftime.org |
| PicoGym / CSAW | Student competitions | Search official NYU / CMU event pages |
OWASP & secure coding
| Resource | Type | Official |
|---|---|---|
| OWASP Foundation | Standards, Top 10, chapters | owasp.org |
| OWASP Juice Shop | Vulnerable web app (legal practice) | owasp.org/www-project-juice-shop |
| OWASP WebGoat | Learning environment | owasp.org/www-project-webgoat |
| OWASP ASVS | App security verification | owasp.org/www-project-application-security-verification-standard |
| SAMM | Software assurance maturity | owaspsamm.org |
Bug bounty platforms (official only)
Register and read program scope before testing.
| Platform | Official |
|---|---|
| HackerOne | hackerone.com |
| Bugcrowd | bugcrowd.com |
| Intigriti | intigriti.com |
| YesWeHack | yeswehack.com |
| Google VRP | bughunter.withgoogle.com |
| Meta Bug Bounty | facebook.com/whitehat |
Cert paths (vendor-official — optional, not required to learn)
| Cert / path | Official |
|---|---|
| CompTIA Security+ | comptia.org |
| OffSec (OSCP path) | offsec.com |
| SANS / GIAC | sans.org |
Student & campus communities
| Resource | Notes | Official |
|---|---|---|
| OWASP Student Chapters | University chapters | owasp.org/chapters |
| Cybersecurity Club (generic) | Search {your university} cybersecurity club |
Campus site |
| CSAW | Student security research / competitions | csaw.engineering.nyu.edu |
| DEF CON Groups | Local meetups | defcongroups.org |
Grants for security OSS
See build-grants (GitHub Secure OSS, NLnet, OpenSSF).
JSON index: data/security-resources.json