chs.us

I’m a security researcher and application security engineer focused on vulnerability research, web security, and building tools to make application security easier. I founded the OWASP Indianapolis Chapter in 2005 and curate appsec.fyi, a collection of application security resources.

I’m a Senior Security Researcher on the Azure DevSec team at Microsoft, where I hunt SSRF and other web vulnerability variants across the Azure ecosystem. Before that I worked at Proofpoint, Salesforce, Teradata, and Anthem. On my own time I do memory-safety research in C/C++ media software — a use-after-free I found and patched shipped in Kodi v22, and I’m credited in an upstream FFmpeg fix. I’ve spoken at DerbyCon and CircleCityCon on topics like extending Burp Suite and Ruby security.

More about me →

Featured Work

🚀 Application Security Guides

In-depth references for the vulnerability classes I work with most — XSS, SQLi, SSRF, IDOR, RCE, deserialization, API and mobile security — each covering attack surface, exploitation, and defense.

Browse the guides →

🎯 OWASP Top 10 2025: Complete Developer Security Guide

Just released: The definitive guide to OWASP Top 10 2025 - the first comprehensive analysis of the latest web application security risks. Covers new categories like Software Supply Chain Failures and Exception Handling, plus major ranking changes that reflect modern attack patterns.

Why this matters: Based on analysis of 175,000+ CVE records, this isn’t just an update - it’s a complete rethinking of web security priorities. Supply chain attacks finally made the top 10, and security misconfigurations jumped to #2.

Read the Complete OWASP 2025 Guide → | Published May 2026

Security Topics

Explore by vulnerability class:

🎯 SSRF (Server-Side Request Forgery) - Complete prevention guide
⚡ XSS (Cross-Site Scripting) - Defense strategies & CSP implementation
🐍 Python Security - Secure development practices