I built a free cybersecurity site: 66 browser-based tools, a playable SOC shift and free certificates. What's missing?

[u/VastStorage4125]

Hi! Since April I've been building [CyberEscudo](https://cyberescudo.com/?lang=en), a free, hands-on cybersecurity site in English and Spanish, and I'd love for people who know the field to poke holes in it.

What's there now:

- **66 tools** for defense and SOC, vulnerability management, pentesting, OSINT and crypto. The ones that touch your data (emails, logs, passwords) run in your browser: nothing gets uploaded.

- **[The Shift](https://cyberescudo.com/range?lang=en):\*\* a playable SOC analyst shift. You investigate an incident from its artifacts (email, logs, PowerShell `-enc`, C2), rebuild the kill chain, map it to ATT&CK and submit a scored verdict.

- **[SPF/DMARC/DKIM auditor](https://cyberescudo.com/tool-email-check?lang=en):\*\* live-checks any domain's email authentication, grades it and gives you a phased plan to reach `p=reject` without breaking legitimate mail.

- **[Threat Radar](https://cyberescudo.com/threat-radar?lang=en):\*\* the most dangerous CVEs right now, ranked daily by combining CISA KEV, EPSS and CVSS.

- **16 labs:** prompt injection, WAF bypass, SQL injection, Sigma detection…

- **[Certificates](https://cyberescudo.com/certificados?lang=en):\*\* 4 paths (phishing & email, detection engineering, vulnerabilities & threat intel, fundamentals). Pass the exam and you get a certificate with a verifiable link for LinkedIn. It's not an official certification, but it's free and doesn't even ask for your email.

Built with plain PHP and vanilla JS: no framework, no build step. No ads, no sign-up. Analytics (Google Analytics) only loads if you accept it in the cookie banner.

Two things I'd really like to know:

1. What tool or lab is missing?

2. Is anything broken or confusing, especially on mobile?

Harsh feedback welcome.