🛡️ Security Engineer

DEEV PAL

Breaking & Building Security

// whoami

The Journey

My journey into cybersecurity started with a simple curiosity — what happens when you push software beyond what it was designed to do? That question led me from hunting bugs on public platforms to securing some of the world's largest products at scale. With a Bachelor's in Computer Applications from The Heritage Academy (CGPA: 9.08) and a Master's in Computer Science from BITS Pilani, I built a strong academic foundation — but the real education came from breaking things.

I cut my teeth in the bug bounty world early on, earning Hall of Fame recognitions from Atlassian, Trello, OpenAI, Butler, and SurveyMonkey. That offensive mindset became the backbone of everything I do. I spent nearly 4 years at SAP Labs as a Product Security Engineer, where I performed penetration testing and threat modeling across 15 enterprise applications, managed 16+ customer pentest reviews end-to-end, and automated open-source security scanning workflows that reduced manual effort by 80%. I also built custom security tools from scratch — an API Fuzzer for AI-based services, a log scanner for sensitive data leaks, and a ZAP-based DAST tool tailored for SAP's UI5 framework.

In August 2025, I joined Meta's Product Security team (Family of Apps) in London — and that's where everything leveled up. I saw an opportunity to multiply security impact through AI, and I ran with it. In under 9 months, I've built 4 AI-powered security agents that automate XSS detection, security design reviews, ACL risk assessment, and feature launch monitoring. One of those agents — Sever-Agent — secured 819,000 insecure ACLs in just 9 hours. I've shipped 50+ diffs, triaged 250+ vulnerabilities across 3 oncall rotations (including XSS via Google-served docs, SQL injections, and RCEs), and authored 90+ security commits.

Today, my work sits at the intersection of offensive security, AI/ML, and security engineering at scale. I believe the future of application security isn't just finding bugs — it's building intelligent systems that find, fix, and prevent them autonomously. Whether it's designing multi-agent architectures, writing AQF rules for production, or deep-diving into payment credential flows, I bring a hacker's mindset to every line of code I review and every system I defend.

// system.overview

Impact Dashboard

50+Diffs Shipped @ Meta
819KInsecure ACLs Secured
250+Vulns Triaged
4AI Security Agents Built
30+Security Reviews
90+Security Commits
5Hall of Fames
15+Apps Pen Tested
// projects.meta

AI Security Arsenal @ Meta

AI-powered security agents I designed and built at Meta — automating vulnerability detection, security reviews, and access control at billion-user scale.

🔍

XSS Reviewer Agent

Analyzed 264 sinks across 160 files in 17 mins — found 13 XSS

Built a multi-tier Confucius agent specifically targeting ServerHTML and dangerouslySetInnerHTML sinks across Meta's React/JS codebase. Started with a 2-agent architecture (Main Agent + Hop Analyzer) and iterated it into a full 5-tier fan-out system with specialized subagents:

  • Tier 0 — Orchestrator: Finds all sinks, coordinates fan-out, aggregates final verdicts
  • Tier 1 — Source Tracker: Backward data-flow analysis across JS/PHP/Hack/GraphQL boundaries
  • Tier 2 — User Control Check: Determines if sources can be influenced by any user
  • Tier 3 — Security Reviewer: Deep review with 7-question decision tree and 18+ source type matrix
  • Tier 4 — Security Critique: Adversarial review with 17-item gap checklist and fabrication detection

Follow-up: Added batch-mode fast-path with streaming results and crash recovery. Also ported the entire agent as a Claude Code plugin with 4 skills for the prodsec-review pipeline. Built an XSS remediation skill that generates prioritized code fixes (P0–P5) with BEFORE/AFTER diffs.

ConfuciusClaude CodeHack/PHPPythonLLM AgentsBigGrepGlass
🤖

Sever-Agent (ACL Risk Scanner)

819,000 insecure ACLs secured in just 9 hours

Designed and built an automated ACL risk assessment agent that scans and secures insecure access controls across Meta's entire infrastructure. The agent systematically evaluates whether Keychain secret ACLs should be restricted or remain open, using a Security Triager Agent pattern.

  • Built PZM verifiers (ThriftServiceInsecureACLVerifier) to detect overly permissive ACL configurations on Thrift services
  • Added support for Crypto Project and Laser Tier ACL analysis with consolidated task-per-target approach
  • Integrated with Perpetrator for security event tracking, routing events to different queues by L2 surface
  • Maintained insecure identity blocklists and configured async tier jobs via Butterfly + Conveyor

Follow-up: Developed AQF (Automated Quality Framework) rules for automated ACL security checks at production across 5+ asset categories. Created rules to flag high-SIR TIER ACLs with overly permissive “open to ALL” access entries.

PythonAQFPZMThriftACLsConveyorButterfly
📝

AI Security Consultant (MFT)

Reduced manual engineer workload by 30%

Built a multi-agent AI system to automate the triage and analysis of MFT (Money Flow Transfer) security consult requests. The agent processes Office Hours documents, evaluates them against Paysec/PCI DSS frameworks, and generates structured risk assessments with severity ratings.

  • Iterated through 3 output formats: Google Docs → JSON → Structured JSON for pipeline integration
  • Separated OH documents into batches for parallel processing, fixing corner cases in risk scoring
  • Added risk review score and severity rating to final output for automated downstream routing
  • Upgraded to Claude Sonnet 4.5 with improved security-focused prompts

Follow-up: Used the agent to process real MFT consults including Crypto Projects security reviews, FI FinNet assessments, and Billing ML Feature Table privacy evaluations.

MetamateDevmateGraphQLSandcastleClaude 4.5
🕷️

AI Security Crawler

25% signal-to-noise ratio across 10+ monitored surfaces

Built an AI-powered security crawler that continuously monitors Workplace groups for security-relevant feature launches and risks. The system automatically analyzes posts, crawls linked Google Docs and wiki pages, and generates security risk assessments routed to the Perpetrator event system.

  • Migrated from Metamate (M8) LLM pipeline to Devmate agent via Sandcastle for better reliability
  • Built end-to-end Butterfly Bot integration with async jobs for automated workplace post monitoring
  • Fixed subagent JSON passthrough, streamlined Perpetrator UI, added linked docs tracking
  • Onboarded WhatsApp groups, Lite experiment discussions, and Mobile Web surfaces

Follow-up: Generalized the crawler into a full Security Design Review Agent (V0.1) supporting multiple input surfaces with risk scoring and structured analysis output.

ButterflyPerpetratorDevmateSandcastleHack/PHP
// projects.sap_labs + vuln_research

Security Tools & Research

Vulnerability research at Meta and custom security tooling built during 4 years at SAP Labs — from payment credential reviews to purpose-built DAST scanners.

💰

MFT Credentials Security Review

25+ ACLs with transitive access issues → unauthorized money transfers

Led a comprehensive security review of Meta's Money Flow Transfer credential systems. Identified critical transitive access issues in ACLs that could enable unauthorized money transfers. Reviewed Card Network Tokenization flows, NFC Payments (Malibu), Pay-with-X Shopify link account linking, and ASA Support Agent payment/financial agentic tools.

ACLsThreat ModelingCode ReviewScubaThrift/RPC
🔥

Security Oncall & Vulnerability Triage

250+ issues triaged across 3 Prodsec oncall rotations

Served on 3 Prodsec oncall rotations at Meta, triaging a broad range of security issues at scale. Discoveries included XSS via Google-served documents, SQL injection vulnerabilities, and Remote Code Execution (RCE) vectors. Published oncall shift summaries and drove remediation across multiple product teams.

Incident ResponseXSSSQLiRCEProdsec
🧪

API Fuzzer

Built at SAP Labs — Fuzzing tool for AI-based APIs

Developed a custom fuzzing tool designed to test AI-based APIs at SAP. Supported multiple payload types including image uploads, CSV injection, and NLP-based payloads to test model endpoints for input validation flaws, injection attacks, and unexpected behavior under adversarial inputs.

PythonJavaREST APIsFuzzingAI Security
📄

LogsDigger

Built at SAP Labs — Automated sensitive data leak detection

Built an automation utility that scans application log files to identify sensitive data leaks — PII, credentials, tokens, API keys, and other secrets accidentally logged by developers. Reduced the risk of data exposure through log aggregation systems and helped enforce secure logging practices across SAP products.

PythonRegexLog AnalysisData Leakage
🕸️

FioriDAST

Built at SAP Labs — ZAP-based scanner for SAPUI5 & OData

Created a custom web vulnerability scanner built on top of OWASP ZAP, specifically tailored for SAP's Fiori/SAPUI5 framework and OData services. Addressed the unique challenges of scanning single-page applications with OData backends. Migrated the build system from Maven to Gradle for improved CI/CD integration.

JavaOWASP ZAPSAPUI5ODataGradle
🔎

Open Source Security Automation

Built at SAP Labs — Reduced manual scanning effort by 80%

Automated open-source dependency scanning workflows at SAP using MEND, Blackduck, Trivy, and Grype. Built custom PowerShell scripts integrated with Bamboo CI/CD pipelines and Docker containers to continuously scan for vulnerable dependencies, license violations, and supply chain risks across SAP's product portfolio.

MENDBlackduckTrivyGrypePowerShellDocker
// career.timeline

Experience

Security Engineer

Meta • London, UK
Aug 2025 — Present  |  Product Security - Family of Apps
  • Built 4 AI security agents: XSS Reviewer (5-tier), Sever-Agent, AI Security Consultant, AI Security Crawler
  • Shipped 50+ diffs spanning security automation, vulnerability detection, and access control
  • Secured 819,000 insecure ACLs across Meta infrastructure in 9 hours using Sever-Agent
  • Served on 3 Prodsec oncall rotations; triaged 250+ issues including XSS, SQLi, and RCEs
  • Led security reviews for MFT Credentials, Card Network Tokenization, NFC Payments, Shopify Pay, and ASA Agent tools
  • Developed AQF rules for automated ACL security checks at production for 5+ asset categories
  • Built PZM verifiers for Thrift service ACL enforcement and Crypto Project/Laser Tier analysis
  • Authored 90+ commits for security fixes; created 30+ security review tasks across payments, ads, and social surfaces
  • Ported XSS Reviewer as Claude Code plugin and built XSS remediation skill generating prioritized fixes (P0–P5)

Product Security Engineer

SAP Labs
Aug 2021 — Jul 2025  |  4 Years
  • Performed penetration testing, code review, and threat modeling across 15 SAP enterprise applications
  • Reported multiple vulnerabilities including Business Logic Flaws, CSRF, XSS, and Input Validation issues
  • Managed end-to-end review and response for 16+ customer-conducted penetration tests
  • Automated open source scanning with MEND, Blackduck, Trivy, Grype — reduced manual effort by 80%
  • Built API Fuzzer for AI-based APIs supporting image, CSV, and NLP payloads
  • Created LogsDigger — automation utility to scan log files and identify sensitive data leaks
  • Built FioriDAST — ZAP-based web vulnerability scanner tailored for SAPUI5/OData; migrated Maven to Gradle
  • Integrated scanning workflows with Bamboo CI/CD pipelines and Docker containers
  • Used tools: Burp Suite, ZAP, NMAP, AppScan, Checkmarx, GHAS, Credigger
// skills.matrix

Technical Arsenal

🛡️ Offensive Security

Web Application Security95%
Penetration Testing90%
Vulnerability Research92%
Bug Bounty Hunting88%

🤖 AI & Automation

AI Security Agents95%
LLM Integration90%
Security Automation93%
Multi-Agent Systems88%

🔧 Engineering

Python95%
Hack/PHP85%
GraphQL / Thrift88%
JavaScript / Java82%

🔒 Defense & Architecture

Threat Modeling92%
IAM & ACL Security95%
Secure Code Review90%
Incident Response & SEVs85%
// credentials.verified

Certifications & Recognition

🏆

CompTIA Security+

Industry Standard Certification

🔴

CRTP — Red Team Professional

Altered Security Certified

Atlassian

Atlassian Hall of Fame

Bug Bounty Recognition

Trello

Trello Hall of Fame

Bug Bounty Recognition

OpenAI

OpenAI Hall of Fame

Bug Bounty Recognition

Slack

Slack (Butler) Hall of Fame

Bug Bounty Recognition

SurveyMonkey

SurveyMonkey Hall of Fame

Bug Bounty Recognition

// education.log

Education

Master of Computer Science (MTech)

BITS Pilani
2021 — 2025  |  CGPA: 6.91

Bachelor of Computer Application (BCA)

The Heritage Academy
2018 — 2021  |  CGPA: 9.08
// meta.contributions

Code Contributions @ Meta

📦 50+ Diffs Landed
🔧 90+ Security Commits
📅 Aug 2025 — Present
🎯 30+ Tasks Created
🛡️ 3 Oncall Rotations

Monthly contribution heatmap (Aug 2025 — Apr 2026)

// connect.init()

Let's Connect