Which challenge should I start with?

[kOaDT]

Chapter 1, Reconnaissance & Disclosure, in roadmap order: Public env variable leak. Fifteen minutes, no tooling beyond your browser devtools.

The roadmap is ordered on purpose, and later challenges list the ones they may build on. If you prefer, skipping ahead works fine.

If you want a guided on-ramp with a story instead of a list, the TryHackMe room — The Summer Audit — covers 7 flags across 8 tasks.

And if you get stuck, the floating flag checker in the corner of every page has hints for each challenge, and every challenge has a full walkthrough on the docs site.