130 Days Bug Hunting Learning Challenge
A lot of people applied to join the private Discord for the 0xmun1r 130 Days Bug Hunting Learning Challenge.
Since there were limited spots, not everyone could get in. But hey, not getting selected doesn’t mean you have to miss out on the journey.
So for everyone who couldn’t join the private Discord, here’s something for you:
Public Weekly Learning Path
The main private Discord challenge kicks off on July 5, 2026.
The Public Weekly Learning Path will start a week later, on July 12, 2026, via Substack.
Every week, you’ll get a structured learning plan based on the main challenge, sent straight to your email.
What You’ll Get Every Week
Each weekly newsletter will include:
The main topics to focus on
Free learning resources
Handpicked legal practice labs
A guided PortSwigger Web Security Academy lab path
Practice resources from OWASP Juice Shop, WebGoat, crAPI, and other free platforms
Weekly goals to keep you on track
Instructions for self-practice
A checklist to track your progress
Help with revision and unfinished labs
This public path is perfect if you want to follow along on your own but couldn’t get into the private Discord.
Challenge Structure
Here’s what the full challenge looks like:
130 active learning days
26 weeks of structured learning
A mix of study, labs, notes, research, and revision
A good daily routine would be:
Study — 60 minutes
Practice — 90 minutes
Notes & Research — 30 minutes
For each lab, try to solve it on your own for at least 25 minutes before looking at hints or solutions.
If you get stuck:
Go back and review the theory.
Try a different approach.
Use hints only if you really need them.
Focus on understanding the solution, not just copying it.
Reset the lab and try solving it again on your own.
Weekly Schedule
Sunday to Thursday:
Study, labs, notes, and research
Friday:
Take a break and recharge
Saturday:
Revision, unfinished labs, and weekly review
The newsletter comes out weekly so you can follow along at your own pace.
Public Path vs Private Discord Cohort
With the Public Weekly Learning Path, you’ll get:
Weekly structured guidance
Free resources
Selected practice labs
Self-learning checklists
Revision tips
If you’re in the private Discord cohort, you’ll also get:
A detailed daily roadmap
Private discussion channels
Weekly group review sessions
Progress tracking
Team accountability
Direct support from the community
Just to be clear, the Public Weekly Learning Path isn’t a mentorship program. It’s a self-guided version of the main challenge.
Safety and Ethics
Only practice on:
Legal labs
Intentionally vulnerable apps
Authorized bug bounty programs
Targets where you have clear permission
Never test real websites, systems, or individuals without permission.
Always:
Read the program rules
Stay within scope
Avoid accessing unnecessary data
Never share sensitive info
Use your skills responsibly
Also, just to be real — I’m not a professional bug hunter or an expert. I’m learning too.
This challenge isn’t about becoming a pro overnight.
It’s about learning together, staying consistent, building discipline, and slowly getting better at web security and bug hunting.
Important Dates
Private Discord Cohort Starts: July 5, 2026
Public Weekly Learning Path Starts: July 12, 2026
Challenge Ends: December 31, 2026
Each new weekly path will be sent directly to Substack subscribers via email.
If you couldn’t join the private cohort, this is your chance to still be part of the journey.
Subscribe and get ready for the first Public Weekly Learning Path.
Learn Together • Hunt Together • Grow Together
— 0xmun1