This is a teaching platform for security research, starting with payment systems. One rule matters more than the rest: test only what you own, or what you hold written authorization to test.
Last reviewed 2026-09-28
An account holds your email address, an optional display name, your language, a password hash and, if you turn it on, a two-factor secret. Using the site adds the modules you have marked complete, the courses you are enrolled in, the sessions you have signed in from, and any message you send through the contact button.
You can download all of it as a file, and you can delete your account, from the security page. Both are immediate and neither needs to be requested by email. Deleting is permanent: it removes the account, its sessions, its progress and its messages, and it ends access to any course bought with it. A new account with the same address does not inherit the old one.
Two things outlive a deletion, and both on purpose. The record of a purchase, what was bought, for how much and when, is kept because it is the accounting behind real money; with the account gone it is a course name, an amount and a date that name nobody. And messages sent through the contact button are removed automatically two years after they are sent, whether or not the account still exists.
Payments are handled by Stripe and card details never reach this site. Email is delivered by a partner on a mentelabs.com domain. Neither is used to profile you, and there is no advertising and no third-party analytics anywhere on this site. Where a lesson embeds a video it is hosted on YouTube, and the page shows a still image served from here. Nothing reaches Google unless you press play, and if you never do, YouTube is never contacted at all.
Where a module can be listened to, the voice is synthetic. The recording is made in advance with ElevenLabs, from the text of that module, and is then served from this site like any other file. Listening involves nobody but this site: no player from anywhere else loads in the page, and ElevenLabs is never told that you listened, or that you exist.
This is a teaching platform for payment-systems security. It exists so that researchers, students, penetration testers, engineers building payment systems, and the people who have to defend them can understand how these protocols work, including how they fail.
Everything here is published research, public specification, or analysis of data captured from cards and terminals the author was authorized to test. Nothing on this site is a novel undisclosed vulnerability, and nothing here is offered as a tool for committing fraud.
Test only what you own, or what you hold written authorization to test. That sentence is the whole of the acceptable-use policy, and everything below is a consequence of it.
In most jurisdictions, using a payment credential you are not entitled to use is a criminal offense regardless of your intent, and so is intercepting a transaction between parties who have not asked you to. "It was for research" describes a motive. It is not a legal defense, and it is not one this site can provide you with.
Payment schemes publish test card sets, and test terminals can be bought. If a question can be answered with a test card, answer it with a test card.
Do not send real cardholder data to this site: not in an exercise answer, not in a support message, not in a capture. There is no facility for accepting it and no lawful basis for holding it.
The captures published here were sanitized before they were stored, not before they were published: every account number was replaced with a published test number and every record rebuilt around it, including the certificates that would otherwise let the original be recovered. The method is taught in the course, because getting it wrong is easy and the failure is silent.
You are responsible for your account and for keeping your password and any second factor to yourself. Tell me if you think someone else has access to it. Accounts are for one person; enrollments are not transferable.
Accounts that are used to distribute course material, or to attack this site or its other users, are closed without a refund.
A course is one payment, not a subscription. There is nothing to cancel and nothing that renews. What you buy is access to that course's material for as long as the course exists here.
Payments are not refundable. The material is delivered immediately and in full, including files you download and keep, so there is no version of a return that leaves you without it. Module 1 is free and open to anyone, without an account, precisely so you can judge the depth and the writing before you pay for the rest.
You can dispute a charge with your bank. That is your right as a cardholder and nothing written here takes it away. Be clear about what it does: a dispute withdraws access while it is open, because by that point the money has already gone back. If the dispute is resolved in my favor, access returns on its own.
If something is wrong with what you bought, write to me at sal@salmg.net before you write to your bank. A problem I know about is a problem I can fix.
The lessons, diagrams, exercises and sanitized captures are the author's work and are licensed to you for your own study. Quote from them with attribution; do not republish them wholesale or resell them.
Specifications, papers and reports cited on the references page belong to their authors and publishers, and are linked rather than reproduced.
The material is provided as it is. It is researched carefully and corrected in public when it turns out to be wrong. Several lessons carry a note saying what this course previously got wrong and how it was found. But no course can promise to be current with a field that moves this fast, and none of it is legal, compliance or security advice for your specific system.
To the extent the law allows, the author is not liable for what you do with what you learn here.
Reports about this platform's own security are welcome. Tell me before telling anyone else, give me a reasonable time to fix it, and do not access other people's accounts or data while proving your point. Findings handled that way get credited.