How It Works

Who Curates This?

I'm Carl Sampson, an application security engineer focused on vulnerability research, web security, and building tools that make AppSec easier. I founded the OWASP Indianapolis Chapter in 2005, have spoken at DerbyCon and CircleCityCon, and have done security work at Microsoft, Proofpoint, Salesforce, Teradata, and Anthem. I publish open-source tools, CVE disclosures, and technical writeups on topics like Content Security Policy, memory safety, and SSRF — find me on LinkedIn, GitHub, or X.

The Pipeline

Every resource on appsec.fyi flows through a fully automated pipeline. No CMS, no framework, no manual HTML editing. Just Python scripts, a SQLite database, and cron jobs.

What Gets Built

Each cron build runs many steps in sequence. Here's what it produces:

• 25 topic pages — one per security topic, each with a sortable resource table, difficulty filter, KEV sidebar (recently exploited CVEs mapped to that topic), related topics, comparison links, and FAQ structured data
• Recently added — the newest resources across all topics
• Weekly changelog — everything added in the last 7 days, grouped by topic
• Per-publisher pages — one page per publisher (PortSwigger, OWASP, HackerOne, etc.) listing every indexed resource from that host across all topics
• Tools index — resources grouped by AppSec tool (Burp Suite, sqlmap, nuclei, Frida, …) for tool-focused research
• Embed widgets — iframe-friendly per-topic widgets that other security blogs can drop in via a single <iframe>
• Topic graph — an interactive D3.js force-directed visualization of how topics relate to each other
• Glossary — plain-English definitions of 48 AppSec terms
• Comparisons — 15 side-by-side breakdowns of commonly confused concepts
• Saved-for-later — a per-browser bookmark list rendered client-side from localStorage; no account, no server
• JSON endpoints — links.json, glossary.json, changelog.json, explore.json (token-protected; the iOS app is the primary consumer)
• RSS feeds — one main feed, 25 per-topic feeds, plus a changelog feed
• llms.txt — structured index for LLM crawlers (ChatGPT, Claude, Perplexity)
• Sitemap — content-hash based so lastmod only changes when content actually changes

Automation Schedule

Quality Control

Not everything that gets bookmarked makes it to the site. Several layers of quality control run automatically:

• Deduplication — the same URL can't appear twice under the same topic
• Off-topic filter — an automated relevance check hides items that share a keyword but aren't actually about the topic (e.g., WW2 trivia matching "SSRF")
• Difficulty & tool classifiers — each item is auto-tagged so visitors can filter by skill level or by the AppSec tool involved
• Broken link checker — runs monthly, automatically hides resources that return 404s or connection errors after two consecutive failures
• Health badges — each topic on the homepage shows whether it's actively updated, stable, or going stale
• Click tracking — anonymous engagement data informs trending and curation decisions

The Stack

The entire site is static HTML. No React, no Next.js, no Tailwind, no build tools. Pages load fast: critical CSS is inlined, the rest preloads, all assets carry content-hash cache-busters with one-year immutable caching, and HTML/CSS/JS are all pre-compressed at build time. The server runs on a single small VPS with HTTP/2, HTTP/3 (QUIC), and pre-compressed static files.

Why Build It This Way?

Most resource collections are either manually maintained wikis that go stale, or algorithmically generated link farms with no curation. appsec.fyi tries to be neither — human-curated content with automated infrastructure.

The pipeline is designed so that adding a new resource takes seconds (bookmark it), while everything else — summarization, page generation, distribution — happens automatically. The result is a site that stays fresh without requiring daily maintenance.