01
Adversarial by construction
We enumerate trust boundaries and invariants, then try to break each one the way a patient, well-resourced attacker would. Assumptions are the first attack surface.
NullMeridianStatus In stealth
Security review for software that can’t fail.
NullMeridian is a whitehat security research lab. We model your system formally, attack it adversarially and prove every finding with a minimal, reproducible proof of concept. Working with a small number of teams while in stealth.
Approach01Approach
Every system has an invariant. We find where it breaks.
Some software carries more weight than the rest: money, safety, trust. When it breaks, it breaks loudly. NullMeridian treats security as a research problem: state the invariants precisely, search the space adversarially, and prove each violation with something you can run, before anyone else finds it.
- FocusWhitehat security review
- ForHigh-stakes software
- MethodAdversarial + formal methods
- EvidenceReproducible PoC
- DisclosurePrivate & coordinated
- EngagementsLimited by invitation
- StatusIn stealth
02
Proof, not opinion
Every finding ships with a minimal proof of concept, a root-cause analysis and an impact rating you can check yourself. If we can’t reproduce it, we don’t report it.
03
Quiet by design
A small research team, a limited number of engagements and coordinated, private disclosure. Your findings stay between us and the people who can fix them.
02Process
The protocol.
Four phases, run with lab discipline. Nothing about your system leaves the engagement.
01
0x01 · Model
Build a threat model: assets, actors, trust boundaries, and the invariants your system must never violate.
02
0x02 · Attack
Manual-first adversarial review of design and code, backed by fuzzing, symbolic execution and formal methods where they earn their place.
03
0x03 · Prove
Private report: minimal PoC per issue, root cause, severity reasoning and concrete remediation.
04
0x04 · Verify
Re-test every fix against the original PoC and its variants, so the bug class is closed, not just the instance.
03Coming soon
Request access.
We take on a small number of teams while in stealth. Leave a work email; we’ll reach out when there’s capacity.