Module 00 · Guided builder
The before picture, machine-checked
8 tasks · from What GRC Engineering Is
Learning by doing
Interactive labs
Each module's exercise runs in this page — a simulated machine seeded with the lab's files, whose output is verified against captures from the real thing. Tasks check themselves off as the machine actually changes. Everything you do stays in your browser.
26 of 26 module exercises are live; the rest land wave by wave.
Module 07 · Mixed engines
Two controls, one query, zero screenshots
8 tasks · from Data & Cloud Control Plane
Module 08 · Guided builder
The gate that blocks the bad change
7 tasks · from Infrastructure as Code & Scanning in CI
Module 10 · Guided builder
One spine, many profiles, an honest crosswalk
10 tasks · from The Standards Spine
Module 11 · Guided builder
The control that mitigated nothing
8 tasks · from Threat-informed GRC & Systems/Design Thinking
Module 12 · Guided builder
The compliance package a machine can refuse
8 tasks · from OSCAL & Compliance-as-Code
Module 13 · Guided builder
The control that checks itself
8 tasks · from Continuous Controls Monitoring
Module 14 · Guided builder
The decision memo with a number in it
8 tasks · from Product Ownership & Build-vs-Buy
Module 15 · Guided builder
The coverage spine: one control, seven stages, a green gate
8 tasks · from Capstone: Ship One Control, Fully Engineered
Module 16 · Inspector
Read the control on the wire
8 tasks · from On the Wire: Where a Control's Truth Travels
Module 17 · SQL
One claim, three stores, one real engine
7 tasks · from Same Question, Three Stores: Where Control-Truth Lives at Rest
Module 18 · Inspector
Where the claim can be true
10 tasks · from Where the Claim Can Be True: Tracing a Request Through the Tiers
Module 19 · Inspector
Four counters, one control question
13 tasks · from Four Counters, One Question: REST / SOAP / GraphQL / gRPC and Where the Control Lives
Module 20 · Inspector
Whose control is it?
6 tasks · from Whose Control Is It? Reading the Responsibility Boundary
Module 21 · Inspector
Peel the image, read the control baked in
7 tasks · from Peel the Image: Where a Workload's Control-Truth Is Baked In
Module 22 · Inspector
The padlock is a lie until you read the cert
13 tasks · from The Padlock Is a Lie (Until You Read the Cert)
Module 23 · Inspector
The valet key — read who you are and what you may do
9 tasks · from The Valet Key: Reading Who You Are and What You May Do
Module 24 · Inspector
Read the request lifecycle on the wire
12 tasks · from From a URL in a Box to a Chain of Trust: Reading the Request Lifecycle on the Wire
Module 25 · Inspector
Read the control on the log line
10 tasks · from The Field That Proves It: Reading a Log Line as Continuous Evidence
Your badges
0 ptsDerived from your completions (0 done, 0 clean) — recomputable, browser-local, no leaderboard.
First Evidence (locked)
Completed your first interactive exercise.
Foundations Laid (locked)
Completed every exercise in modules 00–06 (Mindset + Tier 1 Foundations).
Clean Run (locked)
Completed an exercise without revealing a single answer.
Evidence Keeper (locked)
Built an evidence chain at least 5 entries long.
The Full Loop (locked)
Completed all 16 module exercises — the irreducible loop, end to end.
Profile & cross-device sync
There is no server and no account — your progress lives in this browser. To move it, you carry it yourself as an encrypted blob only your passphrase can open.
Profile
Optional display name — stored in this browser only and included in your encrypted sync payload.
Export your progress
Produces one encrypted blob (AES-256-GCM) of ALL your state — progress, completions, evidence chain, artifacts, profile. Pick a long passphrase (4+ random words is a good shape). It is never stored anywhere — lose it and the export can't be opened, by us or anyone.
Import from another browser
Paste or upload a sync blob. You'll see exactly what the merge would take from each side BEFORE anything is applied; applying makes an automatic local backup you can undo.
Optional: your own private GitHub Gist
Push/pull the same encrypted blob to a private gist YOU own, using a fine-grained personal access token with only gist permission. Your token stays in this browser — it's stored in localStorage here, never sent anywhere except api.github.com, and never included in the sync payload. This is your storage, not our service.
Push uses the passphrase from the Export box (encrypts before anything leaves the browser); pull drops the blob into the Import box.