When regex isn’t enough
Whitespace handling bypassed a database restore filter, allowing shell commands to execute on the pgAdmin host.
Independent Security Researcher
Meenakshi S L.
I find and investigate vulnerabilities in open-source software, with a focus on application security and static analysis. I build tools and detections to make security research more effective, and share what I learn through writing, talks, and hands-on workshops.
Previously at Endor Labs and VMware.
Team bi0s and Team Shakti alumna.
Selected research
More writing ↗Vulnerabilities discovered during my work at Endor Labs.
A broken fix, a path to RCE
A symlink validation bypass in artifact extraction enabled arbitrary file writes and a path to remote code execution.
Research and write-up with Cris Staicu.
How I can help
Available for freelance and contract engagements in:
01 / Application security
Test how applications behave
Application security testing, source code review, and investigation of security weaknesses, with clear findings and remediation guidance.
02 / Vulnerability research
Understand the root cause
Vulnerability analysis, patch review, and proof-of-concept development to establish how an issue works and what it affects.
03 / Static analysis & automation
Turn findings into detections
Custom Semgrep rules and security automation that turn recurring vulnerability patterns into repeatable checks.
Writing & tools
Host header validation bypass in Undertow
An analysis of CVE-2025-12543 and the gap in host header validation.
Read the article ↗All writing ↗DevSecret
A command-line tool for a local encrypted vault containing API keys and recovery codes.
Explore DevSecret ↗All projects ↗Talks & community
All talks ↗Some of my best learning has come from people willing to share what they know. Talks and hands-on workshops are one way I pass that on.
Background & contact
My experience spans open-source vulnerability research, static analysis, and security automation at Endor Labs, and application security testing, threat modeling, and secure design reviews at VMware. My roots in Team bi0s and Team Shakti continue to shape how I learn and share knowledge.
I’m currently exploring AI security through research papers and hands-on learning.
Have a question, a topic to discuss, or a project in mind? Feel free to reach out on LinkedIn — I’m always happy to connect and exchange ideas.