I’m a security researcher and application security engineer focused on vulnerability research, web security, and building tools to make application security easier. I founded the OWASP Indianapolis Chapter in 2005 and curate appsec.fyi, a collection of application security resources.
I’m a Senior Security Researcher on the Azure DevSec team at Microsoft, where I hunt SSRF and other web vulnerability variants across the Azure ecosystem. Before that I worked at Proofpoint, Salesforce, Teradata, and Anthem. On my own time I do memory-safety research in C/C++ media software — a use-after-free I found and patched shipped in Kodi v22, and I’m credited in an upstream FFmpeg fix. I’ve spoken at DerbyCon and CircleCityCon on topics like extending Burp Suite and Ruby security.
Featured Work
🚀 Enhanced Security Guides with 2026 Intelligence
Just completed: 20 comprehensive security guides enhanced with 180+ critical CVEs from 2026 using automated intelligence processing. The only security resource with real-time vulnerability integration powered by analysis of 10,247+ insights with 95.3% accuracy.
Explore Enhanced Security Guides → | Updated May 2026
🎯 OWASP Top 10 2025: Complete Developer Security Guide
Just released: The definitive guide to OWASP Top 10 2025 - the first comprehensive analysis of the latest web application security risks. Covers new categories like Software Supply Chain Failures and Exception Handling, plus major ranking changes that reflect modern attack patterns.
Why this matters: Based on analysis of 175,000+ CVE records, this isn’t just an update - it’s a complete rethinking of web security priorities. Supply chain attacks finally made the top 10, and security misconfigurations jumped to #2.
Read the Complete OWASP 2025 Guide → | Published May 2026
Security Topics
Explore by vulnerability class:
🎯 SSRF (Server-Side Request Forgery) - Complete prevention guide
⚡ XSS (Cross-Site Scripting) - Defense strategies & CSP implementation
🐍 Python Security - Secure development practices
Recent Posts
Hand-rolling an LDAP listener to catch Log4Shell callbacks
Fifth in a series on building OAST infrastructure from scratch. Post 1 built the javax.naming.Reference that an LDAP …
Fail the build when your CSP regresses
CSP policies regress silently. That’s the whole problem. Someone adds 'unsafe-inline' to script-src to unblock a …
Multi-tenant isolation as defense-in-depth: when WHERE owner_user_id isn't enough
Fourth in a series on building out-of-band application security testing (OAST) infrastructure from scratch. Earlier …
Six layers to sandbox untrusted Python — and the escape I missed
Third in a series on building out-of-band application security testing (OAST) infrastructure from scratch. Post 1 …
Building an authoritative DNS server in ~200 lines
Second in a series on building out-of-band application security testing (OAST) infrastructure from scratch. The first …