# Not The Hidden Wiki: 5,389 links organized by defensive and offensive work

> A repository that contains no code, ships no releases and has no package to install. What it does have is a directory tree of Markdown files indexing cybersecurity material, a submission process that runs through email and Discord, and a free penetration testing program attached to it.

**notthehiddenwiki/NTHW** — Not The Hidden Wiki - The largest repository of links related to cybersecurity

- Repository: https://github.com/notthehiddenwiki/NTHW
- Website: https://notthehiddenwiki.com
- Stars: 2,194 · Forks: 310
- Language: Unknown
- License: NOASSERTION
- Published: 2026-10-08 · Updated: 2026-10-08 · Language: en
- Canonical page: https://hysenlabs.com/projects/notthehiddenwiki-nthw

## A link index that describes its own size

The repository description calls this the largest repository of links related to cybersecurity, and the README opens with a count: there are already 5389 links on the wiki. That number is the entire product. There is no package.json, no build step, no test suite, no changelog, and the releases list in the repository metadata is empty. Nothing here compiles and nothing installs.

That makes the design decision obvious once you see it. A tool repository has to justify itself through code quality and a release cadence. A link index justifies itself through coverage and curation, and the only way to show coverage is to say the number out loud. The README then makes the pitch in one sentence: knowledge should be free, so links were collected from specialists in their fields into a single wiki that a beginner and a fifteen-year practitioner can both use.

The metadata supports the claim of activity rather than just the claim of size. The repository has 2186 stars and 309 forks, and the last push landed on 2026-09-26. The default branch is `nthw` rather than `main`, so links in the README point at that branch explicitly, which is a small detail that will save you a broken URL if you script anything against it.

One caveat belongs here rather than in a footnote. The category list in the README is cut off mid-entry, ending at the Blue Team incident response path. Everything after that in the directory listing is verifiable from the tree itself, but the README's own walkthrough stops there. If you were relying on the README as an index of categories, you are missing the back half of it and should read the tree instead.

## The taxonomy does the real work

The tree is the specification. Thirty-five top-level entries split into subject directories and community files, and the naming is consistent enough to predict what you will find. Academy covers Awareness, Conferences, Certificates, Compliance and Courses. Blue Team covers Forensics, KQL, MITRE and Incident Response. AppSec splits into articles and threats. Artificial Intelligence and Automation each split three ways, into articles, tools and videos.

That three-way split, articles, tools and videos, is the pattern worth learning because it recurs across the tree. It separates the kind of thing from the format, so you can scan a column by medium rather than by topic. KQL has its own folder inside Blue Team, with articles, tools and videos, which tells you the project considers query languages a discipline rather than a feature of a SIEM.

Subject coverage is wider than a typical offensive tooling list. Alongside Red Team, Bug Bounty and CTF Platforms there is Privacy, Project Management, Infrastructure, Hardware, Radio Frequency, Cryptography, Computer Networks, Programming and DevSecOps. There is also Misc, which is the honest label for everything that did not fit a nicer name, and Collaborations, Z3S Links and Learning Paths, which appear to be community programs rather than pure reference material.

Ambassadors and NTHW-42 are directories inside the same repository, not separate projects, which is a design choice worth noticing. The reference material and the community programs live under one roof and one version history, so a change to the Ambassador Program directory shows up in the same commit stream as a new link in an AppSec list.

## Submissions go to an inbox, not to a pull request

The contribution path is the part most visitors miss, and it is the part that explains how 5389 links accumulated. There is a CONTRIBUTING.md file in the root, and the README's own instruction is to send the list to an email address or reach the maintainer on Discord. The framing is that the wiki cannot exist without readers who contribute, and that anyone can submit tools, publications or recordings.

The incentive is social rather than technical. The README says that as a thank you, contributors are added to a Hall of Fame list, where the maintainer can link a nickname plus whatever social media or website the contributor wants attached. That file exists at the root as HoF.md. A second file, acknowledgements.md, extends the same treatment to speakers from three event series, with links to their profiles and recordings.

Read that arrangement honestly. It optimizes for volume of submissions and for the maintainer's ability to credit people quickly, which is why the intake is email and chat rather than a merge queue with review criteria. It also means link quality is filtered by a person, not by a checklist. If you are planning to rely on this index as an input to a toolchain or an automated feed, the absence of a schema and a review process is a real constraint, and you should spot check anything that matters before you automate around it.

The community surface goes further than intake. The README links a Discord invite, a LinkedIn company page, a YouTube channel and a Meetup group. It also points to a link browser built by a community member at notthehiddenwiki.com/search, which is the practical way to search 5389 entries without reading Markdown files by hand.

## NTHW-42 is a service program, not a link list

One directory breaks the pattern of the rest of the repository. NTHW-42 is described as an initiative that brings together more than 20 cybersecurity specialists to provide penetration testing and red team operations completely free of charge.

The README's justification for it is regulatory. It argues that frameworks like NIS2 and DORA require robust security testing while many organizations cannot afford enterprise grade assessments, and positions the program as closing that gap. The reasoning is straightforward: a shortage of affordable testing capacity is a supply problem, and a pool of volunteers is one way to add supply.

Two things are worth separating. First, this is a service offer aimed at qualifying organizations, not a training exercise or a lab, and it has its own README inside the directory. Second, it attaches a real-world expectation to a repository that otherwise contains nothing but links. If the free-testing program has a meaningful success rate, the same maintainers and contributors who curate the index are the people whose judgment you are trusting twice: once for what they link, and once for what they find in your environment.

The Ambassador Program sits in the same category. It is a directory rather than a page of links, which suggests a roster of people rather than reading material. Together with NTHW-42 and the Hall of Fame, it points at the actual engine behind the repository: a small group of identifiable specialists who curate, present and contribute, and who maintain the index as a by-product of their community work.

## What the metadata says, and what it does not

A few repository facts deserve to be stated plainly because they shape how you should treat anything you find inside.

The license field is NOASSERTION, and a LICENSE.md file exists in the root. Those two facts sit in tension. Until you read that file yourself, you have no basis for assuming that links, notes or text are reusable. For a personal bookmarking habit that distinction does not matter. For anything you intend to republish or fold into a course, it is the first thing to check.

The open issue count is 0, with a last push on 2026-09-26 and no releases published through the repository's release mechanism. Zero open issues on a repository with 309 forks is worth reading as a signal about how intake works rather than as a signal about quality: if submissions arrive by email and Discord, they never appear as issues.

Certificate notes give the Academy folder its specificity. There are dedicated notes files for OSCP, OSED, OSEP, eJPT, BSCP, CISSP, Comptia Security+ and CBBH, which is a broad spread across practical and governance tracks. Compliance is split into GDPR, NIS2, ISO 27001 and an other file, and courses are split by language, with separate Polish and English lists. A Polish-speaking security community running its own conference series, awards a Hall of Fame and maintains a 5000-link index is the most informative single fact in the README, and it explains the shape of the tree better than any of the category names do.

## Conclusion

Treat NTHW as a map rather than a source. Nothing in the repository is executable, there is no release to pin and the license field resolves to NOASSERTION even though a LICENSE.md file sits in the root, so you cannot assume reuse terms for anything you pull out of it. The concrete next step is a single pass: pick the two or three subdirectories that match work you are actually doing this quarter, read the articles lists in those folders, and note which ten links you end up bookmarking. If those ten are worth more than the rest of the tree to you, the index has already paid for itself.

## FAQ

### How many links does Not The Hidden Wiki actually contain?

The README states that there are already 5389 links on the wiki, and the repository description calls it the largest repository of links related to cybersecurity. The count is a self-reported figure maintained by hand, so treat it as the project's stated size rather than an independently verified count.

### How do you submit a link or new material to the project?

Send the list to the maintainer's email address or message them on Discord, both of which are listed in the README. Contributors are added to a Hall of Fame file at the repository root, with a nickname and links of the contributor's choosing, and the maintainer also opens new categories on request.

### What is NTHW-42?

NTHW-42 is an initiative inside the repository that brings together more than 20 cybersecurity specialists to run penetration testing and red team operations free of charge. The README frames it as a response to organizations that need robust security testing under regulations such as NIS2 and DORA but cannot afford enterprise grade assessments. It has its own README inside the NTHW-42 directory.

### Which certifications have study notes in the Academy folder?

The tree lists dedicated notes files for OSCP, OSED, OSEP, eJPT, BSCP, CISSP, Comptia Security+ and CBBH. The same Academy folder splits compliance material into GDPR, NIS2, ISO 27001 and an other file, and separates courses into Polish and English lists.

## Sources

- [Issues](https://github.com/notthehiddenwiki/NTHW/issues)
- [notthehiddenwiki/NTHW on GitHub](https://github.com/notthehiddenwiki/NTHW)
- [Project website](https://notthehiddenwiki.com)
- [README](https://github.com/notthehiddenwiki/NTHW/blob/nthw/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/notthehiddenwiki-nthw