{"@attributes":{"version":"2.0"},"channel":{"title":"chs.us \u2014 Carl Sampson","link":"https:\/\/chs.us\/","description":"Application security engineer writing about web vulnerabilities, Python security tooling, and vulnerability research.","image":{"title":"chs.us","url":"https:\/\/chs.us\/og-image.png","link":"https:\/\/chs.us\/"},"language":"en-us","managingEditor":"carl.sampson@gmail.com (Carl Sampson)","webMaster":"carl.sampson@gmail.com (Carl Sampson)","lastBuildDate":"Wed, 11 Nov 2026 00:00:00 +0000","item":[{"title":"Web Security Hub 2026","link":"https:\/\/chs.us\/guides\/web-vulnerabilities\/","pubDate":"Sat, 17 Oct 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/web-vulnerabilities\/","description":"Every web vulnerability guide in one place: XSS, SQLi, SSRF, CSRF, IDOR, XXE and more, each with the attacks and the defenses side by side.","category":["Security-Guides","Web-Security","Vulnerability-Prevention"]},{"title":"XSS Payloads by Context: Filter, WAF & CSP Bypasses (+ Prevention Checklist)","link":"https:\/\/chs.us\/guides\/xss\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/xss\/","description":"XSS payloads for every injection context, filter and WAF bypasses, CSP bypasses, mXSS and DOM clobbering \u2014 plus the prevention checklist that holds up.","category":["Security-Guides","Xss","Web-Security","Javascript","Penetration-Testing"]},{"title":"API Security Hub 2026","link":"https:\/\/chs.us\/guides\/api-security-hub\/","pubDate":"Sat, 17 Oct 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/api-security-hub\/","description":"Every API security guide in one place: REST and GraphQL testing, authentication and authorization flaws, and the OWASP API Top 10.","category":["Security-Guides","Api-Security","Authentication","Graphql"]},{"title":"Prevent SSRF: Cloud Metadata Theft, Filter Bypasses & Webhook Callbacks","link":"https:\/\/chs.us\/guides\/ssrf\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/ssrf\/","description":"Stop SSRF for real: how cloud metadata attacks, IP and filter bypasses, DNS rebinding, and webhook callbacks work \u2014 plus the egress defenses that hold up.","category":["Security-Guides","Ssrf","Web-Security","Cloud-Security","Penetration-Testing"]},{"title":"Security Testing Hub 2026","link":"https:\/\/chs.us\/guides\/testing-methodology\/","pubDate":"Tue, 05 May 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/testing-methodology\/","description":"The full security testing lifecycle in one place: reconnaissance, fuzzing, methodology, and the automation that ties the whole thing together.","category":["Security-Guides","Penetration-Testing","Security-Testing","Methodology","Reconnaissance"]},{"title":"SQL Injection Payloads: Auth Bypass (ffifdyop), UNION, Blind & WAF Evasion","link":"https:\/\/chs.us\/guides\/sqli\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/sqli\/","description":"SQLi payloads by DBMS: login bypass (ffifdyop raw MD5), UNION, error-based, blind and time-based, OOB, WAF evasion, ORM and NoSQL injection, and SQLi to RCE.","category":["Security-Guides","Sqli","Database-Security","Web-Security","Penetration-Testing"]},{"title":"CSRF: Exploitation, Tokens & SameSite Defense","link":"https:\/\/chs.us\/guides\/csrf\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/csrf\/","description":"CSRF prevention that holds up: SameSite cookies and their gaps, token patterns worth using, and the bypasses that defeat half-finished defenses.","category":["Security-Guides","Csrf","Web-Security","Session-Management","Penetration-Testing"]},{"title":"IDOR: Finding & Exploiting Broken Object Access (+ Testing Checklist)","link":"https:\/\/chs.us\/guides\/idor\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/idor\/","description":"IDOR and BOLA: enumerating object references, bypasses that survive naive fixes, object-level authz that works, and a copy-paste IDOR testing checklist.","category":["Security-Guides","Idor","Authorization","Web-Security","Penetration-Testing"]},{"title":"RCE: Remote Code Execution Attacks & Defense","link":"https:\/\/chs.us\/guides\/rce\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/rce\/","description":"Remote code execution paths by language: command injection, expression language, and deserialization chains, plus how each one gets closed.","category":["Security-Guides","Rce","Code-Injection","Web-Security","Penetration-Testing"]},{"title":"XXE Injection: Payloads, Exploitation & Defense","link":"https:\/\/chs.us\/guides\/xxe\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/xxe\/","description":"XXE payloads you can copy: classic, blind OOB, parameter-entity and XInclude, how XXE turns into RCE, and how to harden each XML parser.","category":["Security-Guides","Xxe","Xml-Security","Web-Security","Penetration-Testing"]},{"title":"Insecure Deserialization to RCE: Gadget Chains in Java, Python, PHP & .NET","link":"https:\/\/chs.us\/guides\/deserialization\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/deserialization\/","description":"How insecure deserialization turns into RCE: gadget chains and language-specific vectors in Java, Python pickle, PHP and .NET \u2014 and how to shut them down.","category":["Security-Guides","Deserialization","Object-Injection","Web-Security","Penetration-Testing"]},{"title":"GraphQL Security: Introspection, Abuse & Defense","link":"https:\/\/chs.us\/guides\/graphql\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/graphql\/","description":"GraphQL security in depth: introspection exposure, authorization bypasses, batching and alias abuse, injection, and subscription risks.","category":["Security-Guides","Graphql","Api-Security","Web-Security","Penetration-Testing"]},{"title":"Authentication Bypass Security Guide","link":"https:\/\/chs.us\/guides\/authentication-bypass\/","pubDate":"Sat, 02 May 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/authentication-bypass\/","description":"JWT authentication bypass techniques for 2026 (alg=none, key confusion, kid injection), plus OAuth, SAML and session bypasses and the fixes.","category":["Security-Guides","Authentication","Security","Bypass","Privilege-Escalation","Access-Control","Oauth","Jwt","Saml"]},{"title":"API Security Testing Checklist & Guide: OWASP API Top 10, BOLA, GraphQL and JWT","link":"https:\/\/chs.us\/guides\/api-security\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/api-security\/","description":"An API security testing checklist mapped to the OWASP API Top 10: recon, BOLA\/BFLA, mass assignment, rate limits, GraphQL, JWT and OAuth, plus fixes.","category":["Security-Guides","Api-Security","Web-Security","Authentication","Penetration-Testing"]},{"title":"Authorization & Access Control: Flaws & Fixes","link":"https:\/\/chs.us\/guides\/authz\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/authz\/","description":"Authorization flaws in practice: horizontal and vertical privilege escalation, IDOR, broken access control, and the fixes that actually hold.","category":["Security-Guides","Authorization","Access-Control","Web-Security","Penetration-Testing"]},{"title":"How to Pentest iOS & Android Apps: Methodology, Bypasses & Instrumentation","link":"https:\/\/chs.us\/guides\/mobile\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/mobile\/","description":"A working mobile app pentest methodology for iOS and Android: which platform controls to trust, how to bypass them, and runtime instrumentation in practice.","category":["Security-Guides","Mobile-Security","Ios-Security","Android-Security","Penetration-Testing"]},{"title":"Python Security: CVEs, Django & Flask Hardening","link":"https:\/\/chs.us\/guides\/python\/","pubDate":"Sat, 02 May 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/python\/","description":"Python security end to end: pickle and YAML deserialization, eval and command injection, SSTI in Jinja2, plus Django and Flask hardening.","category":["Security-Guides","Python-Security","Web-Security","Supply-Chain-Security","Static-Analysis"]},{"title":"Continuous Fuzzing That Finds Real Bugs: Harnesses, Coverage & CI","link":"https:\/\/chs.us\/guides\/fuzzing\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/fuzzing\/","description":"Fuzzing that actually finds bugs: harness design, coverage feedback, CI\/CD integration, crash triage, and the bug classes that survive continuous fuzzing.","category":["Security-Guides","Fuzzing","Testing","Vulnerability-Research","Security-Testing"]},{"title":"Recon: Asset Discovery & Attack Surface Mapping","link":"https:\/\/chs.us\/guides\/recon\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/recon\/","description":"Reconnaissance that finds real attack surface: subdomain enumeration, cloud and container discovery, API mapping, and continuous monitoring.","category":["Security-Guides","Reconnaissance","Attack-Surface","Enumeration","Penetration-Testing"]},{"title":"OSINT: Pivoting, Sources & Operational Security","link":"https:\/\/chs.us\/guides\/osint\/","pubDate":"Sat, 02 May 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/osint\/","description":"OSINT methodology end to end: people and infrastructure pivoting, social and blockchain sources, automation, and staying operationally quiet.","category":["Security-Guides","Osint","Intelligence-Gathering","Reconnaissance","Social-Engineering","Ai-Osint","Blockchain-Investigation"]},{"title":"Finding leaked secrets with Google and GitHub dorks: OpenAI keys (sk-proj-), inurl:secrets, .npmrc and token prefixes","link":"https:\/\/chs.us\/guides\/secrets\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/secrets\/","description":"Dorks for leaked sk-proj-, sk-ant- and gsk_ keys in .env, JavaScript bundles and paste sites, plus how to revoke, rotate and check a leaked key.","category":["Security-Guides","Secrets-Management","Credential-Leakage","Security-Tooling","Devops-Security"]},{"title":"Bug Bounty Methodology: A Recon-to-Report Workflow That Finds Paid Bugs","link":"https:\/\/chs.us\/guides\/bug-bounty\/","pubDate":"Sat, 02 May 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/bug-bounty\/","description":"A repeatable bug bounty methodology, recon to report: find paid bugs, chain lows into criticals, and write reports that get triaged fast. Built from real hunts.","category":["Security-Guides","Bug-Bounty","Vulnerability-Research","Ethical-Hacking","Penetration-Testing"]},{"title":"BOLA, BFLA & BOPLA: The API Authorization Testing Checklist","link":"https:\/\/chs.us\/guides\/bola-bfla-checklist\/","pubDate":"Sat, 17 Oct 2026 12:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/bola-bfla-checklist\/","description":"A copy-paste checklist for testing API authorization: BOLA (object), BFLA (function) and BOPLA (property) bypasses, the setup, and how to prove impact.","category":["Security-Guides","Api-Security","Authorization","Access-Control","Bug-Bounty","Web-Security"]},{"title":"Software Supply Chain Security Guide","link":"https:\/\/chs.us\/guides\/supply-chain\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/supply-chain\/","description":"Supply chain security in practice: dependency confusion, compromised packages, CI\/CD attacks, and using SBOMs and provenance to catch them.","category":["Security-Guides","Supply-Chain-Security","Devops-Security","Dependency-Security","Ci-Cd-Security"]},{"title":"Burp Suite: Extensions, Workflows & Automation","link":"https:\/\/chs.us\/guides\/burp-suite\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/burp-suite\/","description":"Burp Suite past the basics: BChecks and Bambdas, writing your own extensions, CI\/CD integration, and workflows that scale beyond manual testing.","category":["Security-Guides","Burp-Suite","Web-Testing","Security-Tools","Penetration-Testing"]},{"title":"Secure LLM & AI Apps: Prompt Injection, Jailbreaks & Agent\/MCP Abuse","link":"https:\/\/chs.us\/guides\/ai\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/ai\/","description":"LLM and AI app security that holds up: prompt injection, jailbreaks, agent and MCP tool abuse, model supply-chain risk, and the defenses to deploy first.","category":["Security-Guides","Ai-Security","Llm-Security","Prompt-Injection","Machine-Learning"]},{"title":"Authentication Security: Attacks & Hardening","link":"https:\/\/chs.us\/guides\/authentication\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/authentication\/","description":"Authentication attacks and hardening: SSO and SAML bypass, MFA weaknesses, credential stuffing, and session handling that resists them.","category":["Security-Guides","Authentication","Sso-Security","Mfa-Security","Web-Security"]},{"title":"JWT Attacks: alg=none, Key Confusion & kid Injection (+ RFC 8725 Checklist)","link":"https:\/\/chs.us\/guides\/jwt\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/jwt\/","description":"JWT attacks that still work: alg=none, RS256\u2192HS256 key confusion, kid\/jku\/jwk header injection, weak HMAC secrets \u2014 plus an RFC 8725 hardening checklist.","category":["Security-Guides","Jwt-Security","Token-Security","Authentication","Web-Security"]},{"title":"SSTI to RCE: Payloads for Jinja2, Twig, FreeMarker, Thymeleaf & Velocity","link":"https:\/\/chs.us\/guides\/ssti\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/ssti\/","description":"SSTI detection and RCE payloads by engine \u2014 Jinja2, Twig, FreeMarker, Thymeleaf, Velocity, Go \u2014 with sandbox escapes, WAF bypasses and fixes that work.","category":["Security-Guides","Ssti","Template-Injection","Rce","Web-Security"]},{"title":"Session Fixation, Hijacking & the Cookie Flags That Matter: Session Security","link":"https:\/\/chs.us\/guides\/session-management\/","pubDate":"Sat, 02 May 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/session-management\/","description":"Session security that holds up: fixation and hijacking explained, the cookie flags that actually decide CSRF exposure, token handling, and clean logout.","category":["Security-Guides","Session-Management","Cookie-Security","Web-Security","Authentication"]},{"title":"Security Conferences 2027: Dates, Open CFPs & Speakers Wanted","link":"https:\/\/chs.us\/guides\/talks\/","pubDate":"Fri, 10 Apr 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/talks\/","description":"Security conferences 2027 by date, plus the ones with speakers wanted: open CFPs, deadlines and speaker perks, and how review boards pick talks.","category":["Security-Guides","Security-Conferences","Talks","Research","Ctf"]},{"title":"Business Logic Flaws: Abuse Cases & Testing","link":"https:\/\/chs.us\/guides\/business-logic-flaws\/","pubDate":"Sat, 02 May 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/guides\/business-logic-flaws\/","description":"Business logic flaws never show up in a scanner. Workflow bypasses, race conditions, and payment logic abuse, and how to find and prevent them.","category":["Security-Guides","Business-Logic","Workflow-Bypass","Race-Conditions","Web-Security","Penetration-Testing"]},{"title":"An AI Agent Deleted a Production Database. Here's How to Stop Yours.","link":"https:\/\/chs.us\/2026\/10\/least-privilege-ai-agents\/","pubDate":"Mon, 19 Oct 2026 12:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/2026\/10\/least-privilege-ai-agents\/","description":"An AI agent deleted a production database in 9 seconds. Here's how to lock down AI coding agent permissions, with a copy-paste checklist.","category":["Security","Ai-Security","Llm-Security","Access-Control","Authorization","Appsec"]},{"title":"WebAssembly security: what the sandbox actually gives you (and what it doesn't)","link":"https:\/\/chs.us\/2026\/10\/webassembly-security\/","pubDate":"Tue, 13 Oct 2026 12:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/2026\/10\/webassembly-security\/","description":"Wasm is sandboxed, but not memory-safe inside its own linear memory. A compiled demo of an overflow silently corrupting a neighbor, and where the real risk is.","category":["Security","Webassembly","Wasm","Memory-Safety","Sandbox","Appsec","Wasi"]},{"title":"Extending Burp Suite (DerbyCon 2017)","link":"https:\/\/chs.us\/speaking\/extending-burp-suite\/","pubDate":"Mon, 12 Oct 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/speaking\/extending-burp-suite\/","description":"My DerbyCon 2017 talk on writing Burp Suite extensions: the Extender API, passive and active scan checks, and a live demo. Video and slides."},{"title":"Ruby and Security (CircleCityCon 2015)","link":"https:\/\/chs.us\/speaking\/ruby-and-security\/","pubDate":"Mon, 12 Oct 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/speaking\/ruby-and-security\/","description":"My CircleCityCon 2015 talk on Ruby for security work: why the language fits, and the tools built on it, from Metasploit to Brakeman. Video and slides."},{"title":"Security Conference Speaking","link":"https:\/\/chs.us\/speaking\/","pubDate":"Mon, 12 Oct 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/speaking\/","description":"Conference talks and presentations by Carl Sampson on application security, Burp Suite extension development, and Ruby security."},{"title":"Security Research & Advisories","link":"https:\/\/chs.us\/research\/","pubDate":"Sat, 12 Sep 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/research\/","description":"Vulnerability research by Carl Sampson \u2014 upstream-merged memory-safety fixes in Kodi and FFmpeg, plus how to report a security issue to me."},{"title":"Vulnerability Disclosure Policy","link":"https:\/\/chs.us\/disclosure\/","pubDate":"Sat, 12 Sep 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/disclosure\/","description":"How to report a security vulnerability in chs.us or in software maintained by Carl Sampson \u2014 scope, expectations, and safe harbor."},{"title":"About Carl Sampson \u2014 Security Researcher","link":"https:\/\/chs.us\/about\/","pubDate":"Wed, 09 Sep 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/about\/","description":"Carl Sampson, security researcher at Microsoft and OWASP Indianapolis founder. Vulnerability research, web security, and Python security tooling."},{"title":"My Other Sites","link":"https:\/\/chs.us\/sites\/","pubDate":"Wed, 09 Sep 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/sites\/","description":"Security tools and resources I've built to help developers and security teams."},{"title":"Security Tools & Projects","link":"https:\/\/chs.us\/projects\/","pubDate":"Wed, 09 Sep 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/projects\/","description":"Open-source tools and resources I've built for the application security community."},{"title":"Uses","link":"https:\/\/chs.us\/uses\/","pubDate":"Tue, 08 Sep 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/uses\/","description":"Tools, software, and hardware Carl Sampson uses for application security research, development, and writing."},{"title":"Hand-rolling an LDAP listener to catch Log4Shell callbacks","link":"https:\/\/chs.us\/2026\/09\/ldap-ber-listener-from-scratch\/","pubDate":"Fri, 04 Sep 2026 12:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/2026\/09\/ldap-ber-listener-from-scratch\/","description":"Catching a jndi:ldap callback needs your own LDAP server: BER-encoded ASN.1 over TCP, no Host header or SNI. The search base DN is the only signal.","category":["Security","Ldap","Ber","Asn1","Jndi","Log4shell","Oast","Python"]},{"title":"Fail the build when your CSP regresses","link":"https:\/\/chs.us\/2026\/08\/csp-ci-gating\/","pubDate":"Fri, 28 Aug 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/2026\/08\/csp-ci-gating\/","description":"CSP policies regress silently when someone adds unsafe-inline to unblock a widget. How to make CI catch it, and what is actually worth gating on.","category":["Security","Csp","Ci-Cd","Github-Actions","Devsecops","Python","Tools"]},{"title":"Multi-tenant isolation as defense-in-depth: when WHERE owner_user_id isn't enough","link":"https:\/\/chs.us\/2026\/07\/multi-tenant-isolation-defense-in-depth\/","pubDate":"Fri, 24 Jul 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/2026\/07\/multi-tenant-isolation-defense-in-depth\/","description":"One forgotten WHERE clause leaks another tenant's data. Here is a second layer that fails closed automatically, built on a SQLAlchemy hook.","category":["Security","Multi-Tenant","Sqlalchemy","Postgres","Appsec","Defense-in-Depth","Oast"]},{"title":"Six layers to sandbox untrusted Python \u2014 and the escape I missed","link":"https:\/\/chs.us\/2026\/07\/sandboxing-untrusted-python\/","pubDate":"Wed, 15 Jul 2026 12:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/2026\/07\/sandboxing-untrusted-python\/","description":"Running user-supplied Python in production: the six independent layers that contain it, why each exists, and the AST bypass that slipped through.","category":["Security","Sandbox","Python","Seccomp","Landlock","Appsec","Oast"]},{"title":"Interactive Security Tools","link":"https:\/\/chs.us\/tools\/","pubDate":"Fri, 10 Jul 2026 00:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/tools\/","description":"Free, fully client-side appsec tools by Carl Sampson. Learn attacks by running them in your browser. Nothing you paste ever leaves your machine."},{"title":"Building an authoritative DNS server in ~200 lines","link":"https:\/\/chs.us\/2026\/07\/authoritative-dns-from-scratch\/","pubDate":"Wed, 08 Jul 2026 12:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/2026\/07\/authoritative-dns-from-scratch\/","description":"A from-scratch authoritative DNS server for an OAST platform: wildcards, apex records, deliverable MX, ACME challenges, and the subtleties that bite.","category":["Security","Dns","Networking","Oast","Python","Dnslib","Infrastructure"]},{"title":"The OWASP LLM Top 10: A Practitioner's Field Guide","link":"https:\/\/chs.us\/2026\/07\/owasp-llm-top-10\/","pubDate":"Sun, 05 Jul 2026 10:00:00 +0000","author":"carl.sampson@gmail.com (Carl Sampson)","guid":"https:\/\/chs.us\/2026\/07\/owasp-llm-top-10\/","description":"A plain-English walk through the OWASP Top 10 for LLM Applications from someone who reviews AI code for a living, and what each risk means.","category":["Security","Owasp","Llm","Ai","Prompt-Injection","Application-Security","Web-Security"]}]}}