manifesto
Security knowledge should be open, visual and easy to find.
The dominant way of teaching security is failing the people who learn. This project is a concrete bet on another path, and showing beats promising: everything on this page already exists and you can check it in the code.
01 · the problem
How we learn security is broken.
This is an opinion, formed by someone who learned, works and teaches in the field. Five failures that keep repeating:
Memorizing lists instead of understanding connections
SAST, DAST, WAF, IAM, each in its own chapter. Nobody shows where a control fits, what it lets through and which other control covers that gap.
Knowledge behind walls
Expensive courses, loose PDFs, three-hour videos with no search. The people who most need to learn are often the ones with the least access.
Material that ages in silence
No date, no source, no channel to correct it. In security, outdated and wrong information is a risk, not just an annoyance.
Theory without scenario
You learn the name of the control, not the moment it fails. The attacker does not follow the book chapter.
Assessment that measures memory
Memorizing the acronym is easy and proves nothing. What matters is reasoning about an incident you have never seen.
02 · what I stand for
Knowledge is better when it circulates.
Security is a team sport: the more people understand, the harder it is to attack. That is why six principles guide the project:
Open
Code under MIT, content under CC BY-SA 4.0. Anyone can read, copy, adapt, translate and correct it. No login, no subscription.
Easy to access
A fast static site with no cookies and no tracking that works on your phone. Search on a shortcut (Ctrl+K), a list view per stage and keyboard navigation.
Visual
Each domain is a map: what exists, where it fits in the pipeline and how it connects. The structure is part of the explanation.
Verifiable
Primary sources, an update date, a public record of corrections and a validator that fails the build when something is incomplete or points to nothing.
Practical
Step-by-step attack scenarios and quizzes that ask for reasoning. You find out which layer stops each move of the attacker.
Built to evolve
People and coding agents contribute through the same path, with the same guardrails and human review at the end.
03 · why not just a Notion
Notes are a start. Structured knowledge is another category.
Notion is great at what it was built for: taking notes, organizing and collaborating. The comparison below is about another task: publishing structured, verifiable knowledge, where the tool helps maintain quality instead of depending only on the author's discipline.
| criterion | notes workspace (e.g. Notion) | sec/atlas |
|---|---|---|
| Structure | Structure by convention: templates help, but nothing forces you to follow them | Typed topics: sections, sources, quiz and map position are required |
| Connections | Flexible links and relations, with no guarantee of consistency between pages | A graph with typed relations; the build fails if a connection points to nothing |
| Quality | No automatic content verification | A validator (9 rules) and CI on every PR, plus a size budget |
| History and review | Per-page history; peer review depends on a manual process | Git: every change is a reviewable commit, with authorship and reason |
| Ownership | Data lives on the platform (you can export it, but the platform is the source of truth) | Files in your repository, an open license, fork in one click |
| Access | Public reading is possible; collaborating depends on a workspace and permissions | Public and static: opens anywhere, no account |
| Learning | Focused on reading and note-taking; no native paths, scenarios or quizzes | Paths, scenarios, quizzes and progress saved only in your browser |
| Real-time collaborative editing | Excellent: it is its strong point | Not the goal: here collaboration happens through pull requests |
04 · made for people and for agents
An MCP server so coding agents can evolve the project.
The repository ships a local MCP (Model Context Protocol) server with no dependencies. An agent connects, learns the rules, reads what already exists, scaffolds a topic and runs the same validator CI runs, with the same quality limits a person would have.
What the agent can do
list_domains, list_topics· map what already existsget_topic, search· read and find contentget_authoring_guide· load the project rulesscaffold_topic· scaffold a new topicvalidate_content· run the validator
Every new session starts from the same point
The project rules come from the server itself (instructions and the contribution guide), so a new session does not depend on old context: it connects, reads the guide and knows what to do and what the build requires.
The guardrails live on the project side: scaffold_topic only creates a new file, refuses suspicious paths and never overwrites, and the build does not pass with incomplete content.
{
"mcpServers": {
"sec-atlas": {
"command": "node",
"args": ["--import", "./scripts/content-alias-loader.mjs", "mcp/server.mjs"]
}
}
}Agents propose, people review. AI-assisted contributions are welcome, as long as the author verifies every claim and declares the use in the pull request. The goal is to speed up writing without giving up accuracy.
Learn, correct, improve.
If you study security, start with a path. If you work in it, the most valuable way to help is to find what is wrong and say so. If you build with agents, connect the server and propose a topic.
— Vitor Sienna. about me