csp-toolkit

A Python library and CLI for parsing, analyzing, and finding bypasses in Content Security Policy headers. It runs 21 weakness checks, scores policies A+ to F, and cross-references whitelisted domains against a database of 79 known-exploitable JSONP endpoints, CDN gadgets, and arbitrary hosting domains.

Features: batch scanning, subdomain variance detection, nonce reuse detection, header injection testing, violation report analysis with fix suggestions, stacked CSP intersection, monitoring with change alerts, CSP generation, Nuclei templates, and a Chrome extension.

pip install csp-toolkit

GitHub | PyPI | Blog post

OutOfBits

An out-of-band application security testing platform where the callback response is programmable. Most OAST tools just log the hit and move on. This one runs DNS and HTTP callbacks through a chain of short Python modifiers you write in the UI – DNS rebinding, fire-once tokens, conditional 401s on the SSRF target, whatever the bug actually needs.

Modifiers are version-controlled and executed in a five-layer sandbox: AST allowlist, restricted builtins, rlimits, seccomp, and Landlock.

Visit OutOfBits

appsec.fyi

A curated library of 6,800+ application security resources across 25 topics, organized by vulnerability class. Covers IDOR, XSS, SQL injection, XXE, SSRF, CSRF, RCE, AI security, OSINT, bug bounty, reconnaissance, fuzzing, Burp Suite, GraphQL, and more.

Built as the quick-reference I wanted during security assessments – every resource is hand-picked based on actual use rather than search rankings.

Visit appsec.fyi | Blog post

OWASP Indianapolis Chapter

Founded the OWASP Indianapolis Chapter in 2005 and have run it ever since – 600+ members and quarterly meetings on application security topics for the Indianapolis security community.

I also contribute code to OWASP ZAP, the Zed Attack Proxy.

OWASP Indianapolis

Upstream Security Fixes

Memory-safety research in C/C++ media software, reported and fixed upstream:

  • Kodi – use-after-free in the texture cache. I found it, wrote the patch, and it was merged upstream and shipped in Kodi v22 “Piers”. PR #27972
  • FFmpeg – use of uninitialized memory in the Escape 130 decoder (old_y_avg). I reported it; the upstream fix was merged in April 2026 with a Found-by credit to me. PR #22568

A few more reports are still under coordinated disclosure.