Hey Christopher, 1. Yes, working through those books would get you to a position at any of the best consulting firms for security. As Thomas will tell you, the

Hey Christopher, 1. Yes, working through those books would get you to a position at any of the best consulting firms for security. As Thomas will tell you, they used to ship some of the books I mentioned to candidates to prepare them for interviews at Matasano :). Those books will teach you everything you can learn from books alone; the rest is just up to practice. 2. If you find a Rails vulnerability, the most straightforward path to monetizing it is reporting it directly to the Rails core dev team and registering for a CVE number recognizing you as the researcher. Once the vulnerability is patched, report the fact that you found it and it was patched to Hackerone's Internet Bug Bounty (IBB) program. The IBB program rewards researchers for reporting serious flaws in major software used around the internet. Your interpretation is correct. I use "bug bounties" colloquially to mean web application vulnerabilities, but technically Hackerone's IBB is a bug bounty. The point is that web application vulnerabilities are worth less as a general rule than vulnerabilities that impact a plurality of websites, due to things like vulnerability half life. Hope that helps!