six things about learning smart contract security that no course, thread, or roadmap prepares you for: 1. the gap between "i can explain this bug" and "i can spot this bug in unfamiliar code" is the actual work. everyone teaches the first. almost nobody teaches the second. 2. every audit report you read is teaching you as much as any course, but nobody tells you to read them. 3. defi primitives, aave, uniswap, lending, AMMs, are not optional. you cannot audit what you don't understand. 4. the writeup skill is half the payout. finding the bug is only the other half. 5. AI is the best study partner in the world if you use it right. it's the fastest way to fake your own progress if you don't. nobody's grading your progress. that freedom is both the point and the hardest part. nobody sends you this list. you write it yourself as you go.