Chris Evans

Background

Chris Evans, known online by the handle "scarybeasts," is a British computer security researcher and engineer who studied at the University of Oxford before building a career in software security. Early in his career he wrote vsftpd ("very secure FTP daemon"), a free and open-source FTP server for Unix-like systems designed from the ground up with security as its primary goal. Vsftpd became one of the most widely deployed FTP servers on Linux distributions, valued for its small, security-audited codebase.

Chrome Security and the Chromium Vulnerability Reward Program

Evans joined Google and became head of the Chrome security team, where he worked on hardening the Chrome and Chromium browser codebase against exploitation and on building out the browser's sandboxing and vulnerability-response processes. In this role he helped launch and run the Chromium Security Rewards program, a bug bounty scheme that paid external researchers for responsibly disclosed vulnerabilities in Chromium. The program, along with the related Pwnium competition for Chrome exploits, became a widely cited model for vendor bug bounties and paid out well over a million dollars in rewards to researchers over its early years.

Founding Project Zero

On July 15, 2014, Evans announced the formation of Google Project Zero on the Google Online Security Blog, identifying himself in the post as "Researcher Herder." Project Zero was created as a dedicated, full-time team of security researchers tasked with finding zero-day vulnerabilities in any software, not only Google's own products, with the stated goal of significantly reducing the number of people harmed by targeted attacks. Evans served as the team's first head, building its early culture of technical rigor and its policy of publishing detailed vulnerability writeups on a disclosure deadline. Project Zero went on to uncover and disclose vulnerabilities in operating systems, browsers, and other widely used software from many vendors, and its disclosure practices sparked ongoing industry debate over responsible-disclosure timelines.

Later Career

After his tenure leading Project Zero, Evans moved on to lead security efforts elsewhere in the industry. He joined Tesla Motors to lead security for the company's vehicle software, network infrastructure, and corporate IT systems, and later held the top security position at Dropbox. In December 2021, HackerOne announced that Evans had been appointed as the company's Chief Information Security Officer, and he additionally holds the title of Chief Hacking Officer, working on initiatives that connect external security researchers with organizations seeking to find and fix vulnerabilities.

Significance and Legacy

Evans's work sits at the intersection of defensive engineering and offensive vulnerability research: his early work on vsftpd emphasized secure-by-design software construction, his Chrome security work helped establish large-scale vendor bug bounty programs as a mainstream practice, and his founding leadership of Project Zero created one of the most influential in-house vulnerability research teams in the technology industry. The disclosure norms and research culture established under his leadership at Project Zero continue to shape how major software vendors and independent researchers interact around zero-day vulnerabilities.

Timeline

• 2000sChris Evans creates vsftpd, a security-focused FTP server for Unix-like systems.
• 2010Evans leads Google's Chrome security team and helps establish the Chromium Vulnerability Reward Program (bug bounty).
• 2014-07-15Evans announces the formation of Google Project Zero on the Google Online Security Blog and becomes its first head.
• 2015Evans leaves Google to join Tesla Motors to lead security.
• 2021-12-08HackerOne appoints Evans as Chief Information Security Officer and Chief Hacking Officer.