I’m a security researcher and application security engineer focused on vulnerability research, web security, and building tools to make application security easier. I founded the OWASP Indianapolis Chapter in 2005 and curate appsec.fyi, a collection of application security resources.
I’m a Senior Security Researcher on the Azure DevSec team at Microsoft, where I hunt SSRF and other web vulnerability variants across the Azure ecosystem. Before that I worked at Proofpoint, Salesforce, Teradata, and Anthem. On my own time I do memory-safety research in C/C++ media software — a use-after-free I found and patched shipped in Kodi v22, and I’m credited in an upstream FFmpeg fix. I’ve spoken at DerbyCon and CircleCityCon on topics like extending Burp Suite and Ruby security.
Featured Work
🚀 Application Security Guides
In-depth references for the vulnerability classes I work with most — XSS, SQLi, SSRF, IDOR, RCE, deserialization, API and mobile security — each covering attack surface, exploitation, and defense.
📈 Most-read guides
The pages people actually come here for:
🔑 IDOR - finding and exploiting broken object access, with a testing checklist
💰 Bug Bounty Methodology - my recon-to-report workflow
🕵️ Leaked Secrets - Google and GitHub dorks for API keys and tokens
🧪 JWT Attack Playground - forge and break tokens in your browser
📝 Latest post
An AI Agent Deleted a Production Database. Here's How to Stop Yours.
An AI agent deleted a production database in 9 seconds. Here's how to lock down AI coding agent permissions, with a copy-paste checklist.
Security Topics
Explore by vulnerability class:
🔐 Authorization & Access Control - IDOR, BOLA, BFLA & building an authz layer that holds
🎯 SSRF (Server-Side Request Forgery) - Complete prevention guide
⚡ XSS (Cross-Site Scripting) - Defense strategies & CSP implementation
🐍 Python Security - Secure development practices
Recent Posts
WebAssembly security: what the sandbox actually gives you (and what it doesn't)
Every few months someone tells me WebAssembly is “sandboxed and memory-safe,” usually as a reason they …
Hand-rolling an LDAP listener to catch Log4Shell callbacks
Fifth in a series on building OAST infrastructure from scratch. Post 1 built the javax.naming.Reference that an LDAP …
Fail the build when your CSP regresses
CSP policies regress silently. That’s the whole problem. Someone adds 'unsafe-inline' to script-src to unblock a …
Multi-tenant isolation as defense-in-depth: when WHERE owner_user_id isn't enough
Fourth in a series on building out-of-band application security testing (OAST) infrastructure from scratch. Earlier …
Six layers to sandbox untrusted Python — and the escape I missed
Third in a series on building out-of-band application security testing (OAST) infrastructure from scratch. Post 1 …