What you need to start
A phone or laptop, a browser, a free email, and an afternoon you can protect. No new machine.
Beginner · 8 minRead
CashPlanet Academy · Resource Center
Start here, then the field guides.
Beginner notes and build kits first. The eight engineering field guides stay — they are labelled Field guide on purpose.
Start here7 · Beginner
Setup, a first page, and habits that work on a phone and a thin data bundle.
Typing on the device you have
Laptops, phones, and not waiting for perfect hardware.
Beginner · 8 minRead
Install the free tools
Browser, a place to type, and GitHub. Nothing you have to pay for to begin.
Beginner · 12 minRead
Git without fear
Enough version control to not lose a page — including a first repo from the browser.
Beginner · 14 minRead
Learning on limited data
How to keep practising when the bundle is thin or the power is uneven.
Beginner · 10 minRead
HTML, CSS, JS — enough to ship a UI
A pocket cheatsheet for a page people can actually use. Not a language tour.
Beginner · 12 minRead
AI as a building partner
How to use ChatGPT, Claude, or Cursor when you are still learning — without handing over the work.
Beginner · 12 minRead
Build kits11 · Building
Cheatsheets, local project ideas, free hosting, debugging, one shipped thing, plus curated links.
Prompt cheatsheet
A short brief you can reuse for drafts, code, and checks.
Building · 6 minRead
Project ideas that fit local markets
Four finishable builds — market list, fees tracker, group roster, shop catalog — with acceptance criteria.
Building · 14 minRead
Debugging when you are stuck
Read the error, rubber-duck the page, then ask an assistant well.
Building · 12 minRead
Free hosting in plain language
GitHub Pages, Vercel, and Netlify — what they are, when to use which, no DevOps.
Building · 12 minRead
Portfolio — show one shipped thing
One public URL, one sentence, one screenshot. Do not wait for ten projects.
Building · 10 minRead
MDN Web Docs
The reference we trust for HTML, CSS and JavaScript. Start at Learn web development if the docs feel dense.
Building · LinkOpen
freeCodeCamp
Long, structured practice you can do in a browser. Useful when you want more exercises after a CashPlanet lesson.
Building · LinkOpen
web.dev
Practical guidance on performance, accessibility and building for phones — including slow networks.
Building · LinkOpen
The Modern JavaScript Tutorial
Clear explanations of the language itself. Read a chapter, then go back to your own page and try it.
Building · LinkOpen
Next.js documentation
Official docs for the stack this Academy is built on. Use them when you are ready to ship a real site.
Building · LinkOpen
ALX
Longer software-engineering pathways across several African markets. Complementary to these short tracks, not a replacement.
Building · LinkOpen
Field guides8 · Field guide
Kit guides for software that meets real users, real money and real attackers. Intermediate and advanced.
Security5 guides
Where the UI, the API and the database disagree about who is allowed to do what.
Authorization and IDOR: "Authenticated" Is Not "Authorized"
An endpoint checks that someone is logged in, then performs a destructive or data-revealing action on any object by ID — without checking whether the logged-in user actually owns, is assigned to, or has permission over that object.
Securing Endpoints: Stop Trusting Whoever Can Reach the URL
AI coding tools happily generate an endpoint that does something powerful (sends an email, triggers a webhook side-effect, writes to a database) without asking "who is allowed to call this?", because nobody asked it to.
Database RLS and Privilege Escalation: The UI Is Not the Security Boundary
The app hides the admin panel from non-admins in the UI, but the database itself will still let any logged-in user write is_admin = true on their own row — because nobody locked that column down at the data layer.
Environment Variables and API Keys
A secret key ends up somewhere the public can read it (a browser bundle, a git commit, or an AI chat transcript) because it was treated like configuration instead of a credential.
Form Validation & Security Guide
A comprehensive template for implementing form validation and security in React and Next.js applications.
Payments1 guide
Money paths that only break under retries, duplicates and refunds.
Payments and Webhooks: Money Bugs Hide in the Retry Path
Payment code is written and tested for the single, successful, non-concurrent request — and webhooks, refunds, and duplicate deliveries all happen outside that path, so that's exactly where the bugs live.
Performance & Design2 guides
Working with the browser's rendering pipeline instead of against it.
Browser-Aware Web Design
A practical guide to designing modern websites that work with the browser's rendering pipeline instead of against it. Adapted from Addy Osmani's writing on modern browser internals.
Ship Less JavaScript
Your app downloads its whole codebase before a single pixel renders. Every page, every admin screen, every heavy third-party widget ships in the same bundle, because nothing was ever split into separate chunks.