About
Offensive security that holds up.
ProjectMerai is an offensive-security outfit. We take apart the systems people rely on and understand them to the bottom.
What we are
Research first, not a product pitch
We build tools that are honest about what they find, publish research other people can reproduce, and keep that discipline even when it costs us speed.
Everything ships under the projectmerai organization on GitHub, so the work can be checked instead of taken on faith.
Our first tool, DLLHijackHunter, has been selected for Black Hat Arsenal twice: SecTor in Toronto in October 2026, and Black Hat Europe in London in December 2026.
The name
On “Merai”
Merai is a character from The Still Point, a dark mythological-fantasy novel written by our founder.
It fits for a simpler reason too. Security work throws off a lot of noise: maybes, might-bes, and findings dressed up as more than they are. Our job is to be the part you can trust without a caveat. The tool that reports only what it proved. The write-up that says exactly what was tested and what wasn't. The claim that waited until it was true. Whatever we put our name on has to meet that standard.
How we work
Four things we hold to
- 01
Proof over volume
A short list of things that are true beats a long list of things that might be. We'd rather report three findings we can stand behind than thirty we can't. Not by accident, that's also how DLLHijackHunter works: it confirms a hijack actually loads before it calls it a finding.
- 02
Open by default
We build and publish in the open, methods included, not just results. If we can't explain how we reached a conclusion clearly enough for you to repeat it, it isn't finished.
- 03
Honest about the edges
Every result has a boundary. We say plainly what we tested, what we didn't, and where the claim stops. An honest limit beats a confident guess.
- 04
Craft over noise
No hype, no fear-selling, no dressing up a medium bug as a headline. The work speaks at its real size. Over time, that's louder anyway.