I'm Bishal Bhandari, a security researcher and SOC analyst based in Kathmandu, Nepal. I've spent the last 3+ years at Monal Tech hunting threats, digging through SIEM alerts, and building tools that automate the boring parts of security work so analysts can focus on what actually matters.
My day-to-day lives somewhere between threat intelligence, OSINT investigations, and vulnerability assessments. I'm equally comfortable writing a Python automation script, tracing a blockchain wallet linked to suspicious activity, or documenting a pen test finding with proper CVSS scoring. I also genuinely enjoy building, not just breaking things.
When I'm not in a SIEM dashboard, I'm probably working on one of my open-source projects or reading about something that probably has a CVE.
|
🔍 Intelligence & Investigations
|
🛡️ Security Operations
|
Self-hosted. Security-first. Actually usable.
I built SysCommand because I wanted a server management panel that didn't cut corners on security. It's a full Flask application with real-time system monitoring, Docker container orchestration, and an integrated vulnerability scanner, all gated behind proper RBAC with granular permissions like docker:start and image:scan.
A few things I'm particularly proud of: the Docker socket is never mounted directly into the app, it goes through a docker-socket-proxy (CIS Docker Benchmark compliant). MFA is TOTP-based with backup codes. Every privileged action lands in a structured JSON audit log with CSV/PDF export. The test suite covers unit, integration (Testcontainers), E2E (Playwright), property-based (Hypothesis), contract (Schemathesis), and load testing (Locust).
More details
- Multi-user RBAC with drag-and-drop role editor and toggle-chip permission UI
- TOTP-based MFA with one-time backup codes, optional enforcement at login
- Real-time CPU (per-core), RAM, disk, temperature, and uptime via psutil
- Docker: start/stop/restart/remove, SSE log streaming, image pull with live progress, automated tag-switch lifecycle
- Vulnerability scanning via Grype: CVE dashboard with severity badges, JSON export
- Production hardened: CSP + HSTS + X-Frame-Options (Flask-Talisman), bcrypt cost-12, rate-limited login (5/min), session fixation prevention, CSRF protection
A GPT-style LLM with security compliance baked in, not bolted on.
38M parameter language model built with PyTorch, designed for low-resource hardware. The security angle was the whole point: OWASP ASVS 4.0, CWE Top 25, and CIS controls enforced throughout. Replaced pickle serialization with JSON checkpoints to eliminate the RCE risk that most ML projects ignore. FP16 training and gradient accumulation cut memory usage by 50%.
- ✅ PCI Compliance —> Qualys (2024)
- ✅ OPSWAT File Security Associate (OFSA) -—> 2024
- ✅ Ethical Hacking Essentials -—> 2024
Languages
Security Tooling
Frameworks & Infrastructure
Automation
"Security is not a product, but a process." — Bruce Schneier