I have learned about web application security by getting hands-on experience with typical attack methods. While I am involved in application development and operations, I am not a security specialist.