A comprehensive, self-paced beginner-to-advanced practitioner course with 18 ordered sections and 90 lessons. It builds from lab safety and web/network foundations through reconnaissance, HTTP and sessions, authentication and authorization, input handling, API and business-logic security, tooling, secure design, remediation, evidence, and professional reporting. The advanced track adds trust-boundary and state analysis, synthetic token validation, browser security policy, safe SSRF design review, race-condition modeling, API contracts and object authorization, OAuth/OIDC flow review, GraphQL resolver and query-cost controls, abuse prevention, local container hardening, image provenance and SBOM review, Kubernetes workload/RBAC review, CI/CD permissions, scoped proxy practice, regression testing, triage, evidence handling, and a professional capstone. Plan approximately 75–110 hours, depending on reading and local lab time. Learners should have Docker Desktop, a browser, and basic command-line familiarity. All hands-on testing is restricted to the learner's own local OWASP Juice Shop at http://127.0.0.1:3000, bound to the host loopback address. The public Juice Shop demo, public websites, campus or employer networks, cloud systems, other people's devices, real accounts, credential guessing, destructive actions, data theft, high-volume testing, and denial-of-service testing are out of scope. Advanced OAuth, GraphQL, Kubernetes, and CI/CD lessons use synthetic examples or static review unless a lesson specifically describes a low-impact check against the local app. Each lesson includes Learn & Understand and Hands-on Practice panes, objectives, step-by-step tasks, safe local or synthetic examples, expected results, evidence guidance, knowledge checks with model answers, and a defensive remediation perspective. Video companions are optional; the Juice Shop walkthrough is best watched after independent practice because it may reveal challenge solutions. Students finish with written rules of engagement, a scoped test plan, sanitized evidence, prioritized remediation, positive and negative retest criteria, a professional report, and verified lab cleanup. The connected completion certificate is awarded when all program steps are completed.