130 Days Bug Hunting Learning Challenge

A lot of people applied to join the private Discord for the 0xmun1r 130 Days Bug Hunting Learning Challenge.

Since there were limited spots, not everyone could get in. But hey, not getting selected doesn’t mean you have to miss out on the journey.

So for everyone who couldn’t join the private Discord, here’s something for you:

The main private Discord challenge kicks off on July 5, 2026.

The Public Weekly Learning Path will start a week later, on July 12, 2026, via Substack.

Every week, you’ll get a structured learning plan based on the main challenge, sent straight to your email.

Each weekly newsletter will include:

• The main topics to focus on

• Free learning resources

• Handpicked legal practice labs

• A guided PortSwigger Web Security Academy lab path

• Practice resources from OWASP Juice Shop, WebGoat, crAPI, and other free platforms

• Weekly goals to keep you on track

• Instructions for self-practice

• A checklist to track your progress

• Help with revision and unfinished labs

This public path is perfect if you want to follow along on your own but couldn’t get into the private Discord.

Here’s what the full challenge looks like:

130 active learning days
26 weeks of structured learning
A mix of study, labs, notes, research, and revision

A good daily routine would be:

Study — 60 minutes
Practice — 90 minutes
Notes & Research — 30 minutes

For each lab, try to solve it on your own for at least 25 minutes before looking at hints or solutions.

If you get stuck:

1. Go back and review the theory.

2. Try a different approach.

3. Use hints only if you really need them.

4. Focus on understanding the solution, not just copying it.

5. Reset the lab and try solving it again on your own.

Sunday to Thursday:
Study, labs, notes, and research

Friday:
Take a break and recharge

Saturday:
Revision, unfinished labs, and weekly review

The newsletter comes out weekly so you can follow along at your own pace.

With the Public Weekly Learning Path, you’ll get:

• Weekly structured guidance

• Free resources

• Selected practice labs

• Self-learning checklists

• Revision tips

If you’re in the private Discord cohort, you’ll also get:

• A detailed daily roadmap

• Private discussion channels

• Weekly group review sessions

• Progress tracking

• Team accountability

• Direct support from the community

Just to be clear, the Public Weekly Learning Path isn’t a mentorship program. It’s a self-guided version of the main challenge.

Only practice on:

• Legal labs

• Intentionally vulnerable apps

• Authorized bug bounty programs

• Targets where you have clear permission

Never test real websites, systems, or individuals without permission.

Always:

• Read the program rules

• Stay within scope

• Avoid accessing unnecessary data

• Never share sensitive info

• Use your skills responsibly

Also, just to be real — I’m not a professional bug hunter or an expert. I’m learning too.

This challenge isn’t about becoming a pro overnight.

It’s about learning together, staying consistent, building discipline, and slowly getting better at web security and bug hunting.

Private Discord Cohort Starts: July 5, 2026
Public Weekly Learning Path Starts: July 12, 2026
Challenge Ends: December 31, 2026

Each new weekly path will be sent directly to Substack subscribers via email.

If you couldn’t join the private cohort, this is your chance to still be part of the journey.

Subscribe and get ready for the first Public Weekly Learning Path.

Learn Together • Hunt Together • Grow Together

— 0xmun1