Breaking things.
Teaching everything.
The SPM Tech community hub—the free training projects we build and maintain for the security community, starting with LearnCodeReview.
Everyone should be able to read the code
Security got where it is because people shared what they knew. We would not be doing this work without the researchers, writeups, and open tooling that taught us—so we give back, in public, for free.
- Knowing vulnerability names is not knowing security. Plenty of people can define SQL injection or broken access control. Far fewer can open an unfamiliar codebase and see where the trust boundary actually sits—and that skill is the one that finds real bugs.
- Scanners find patterns; people find logic. Automated tools match known signatures. The findings that matter most—auth bypasses, broken business logic, chained flaws—live in code that no signature describes. You get there by reading.
- Defenders deserve the same knowledge as attackers. Every developer who learns to spot a flaw while writing code removes work from an attacker's list. Teaching code review is not giving away our craft; it is raising the floor for everyone.
- Paywalls slow the whole field down. Good security education should not depend on a training budget. Everything we publish here is free, and stays free.
LearnCodeReview.space
Built and maintained by SPM Tech: a free A–Z catalog of web vulnerabilities, taught the way we actually find them—by reading code.
Learn web security by reading code
Every entry breaks a vulnerability down the same way: how it happens, how attackers find it, and how to remediate it—with wrong-vs-right code examples in JavaScript, Python, Go, C#, and Java, mapped to CWE. From account enumeration to XSS, it's the fundamentals of secure code review, free for everyone.
Free · Built by SPM Tech
Visit LearnCodeReview →Looking for our CVE analyses and vulnerability writeups? They live on the SPM Tech blog →
Want this depth pointed at your own systems?
The same operators who write these breakdowns run our engagements. Tell us your scope and we'll respond within 24 hours—under NDA, on a secure channel.
All communications encrypted · NDA available · Free retest included · Response within 24h