Mateo

Madrid

I've been building software and founding things around it since I was thirteen. I make products people use every day, and I research how systems and the people on them get attacked, from threat intelligence to, lately, a lot of offensive security.

I've been writing software since I was thirteen. I'm proficient in and pretty good with , though a stack doesn't define a developer the way it did before AI.

It started with GW, a community I co-founded that grew to about 500,000 members. While studying for the International Baccalaureate I co-founded Aurax, an e-commerce and marketing company, which grew to about eight people and six figures a year in revenue. Today about a thousand people a day watch through Still, and OPVIM, the organization I founded to protect minors online, runs on my Pervasivity research.

At GW, a 500,000-member and community, I designed the moderation and staff systems from scratch and built the server's infrastructure, from its proxy to its security, for up to a thousand concurrent players. At Aurax I built a quote generator powered by and a system that wrote our pages from a product. Still streams through a restricted proxy on . OPVIM runs on Pervasivity, which collects from our own sources and tracks them continuously for changes.

hi@mateorb.com GitHub

Work

Code

6,604 contributions in my last year on GitHubOct 2025 to Oct 2026

OPVIM

Child-protection organization

Role: Founder and director
When: 2026
Link: Public website

OPVIM, the Observatorio de Protección frente a la Violencia en Internet contra Menores (OPMOV in English), is an organization I founded and direct to protect minors in Spanish-speaking online spaces. It grew out of the reports I handled at GW.

OPVIM's public identity and its operational foundation. The relationship is illustrated; no operational interface or data is shown.

It is at an early stage. I run it on my own, with external collaborators and, when a case calls for it, law enforcement. For now it monitors, builds its technology and reports every finding privately through channels that law enforcement provides. Research and publications are due to begin by the end of 2026.

Its operations run on Pervasivity, the intelligence system I built for it. It collects from our own sources and tracks all of them continuously for changes, much as Palantir’s platforms do.

In June 2026, during the earthquakes in Venezuela, I worked informally to monitor and find missing children, and to make sure they were safe and cared for.

I also designed its identity and Spanish-language website, built around the line Hay vidas detrás de cada pantalla: there are lives behind every screen.

Pervasivity

Intelligence infrastructure

When: 2026

Pervasivity is intelligence infrastructure I build and run. The work starts with understanding how external platforms operate, then turning that protocol research into software that can be used in a specific operational context.

One workspace in its repository looks things up in public sources, preserves each observation as an immutable snapshot, and checks again on a schedule. It separates what was observed from what was inferred and makes changes reviewable over time. The difficult decisions concern provenance, durable state and how external protocols change.

Each lookup is a job with an idempotency key, so asking twice does the work once, and it runs under a lease, so a worker that stops hands the job back instead of leaving it half done. What it finds is written as an immutable snapshot, and history and search read from snapshots, not from the live source.

An observation and a conclusion drawn from it are stored as different things. When two sources disagree about an identity, both are kept with the conflict recorded, and a hypothesis can be withdrawn without rewriting what was seen.

It is deployed, and OPVIM uses a custom implementation for its operations. That application is part of the story, alongside the underlying research. Phantom Media also began in this repository before becoming a separate family of products.

Security research

How platforms work and fail

When: Since 2020

I look for the places where software trusts more than it should. I think a lot about the threats people actually face today. That is why I do offensive security, and why I founded Pervasivity and OPVIM.

Most of my research has stayed private or under coordinated disclosure. Much of it is now coming out, and I add it here as it does.

KRdp2026KDE Plasma

KRdp, Plasma's remote desktop server, asked for a password only on the route it expected a client to take. With a custom user list it offered TLS alongside NLA, and a client that picked TLS walked straight in, because the check after connecting assumed NLA had already verified the user. Anyone who could reach the port could open the desktop without a credential. I reported it four days before Plasma 6.8.1 shipped, and the fix went out in that release.

In non-PAM mode KRdp enabled both FreeRDP_TlsSecurity and FreeRDP_NlaSecurity. A client offering PROTOCOL_SSL negotiated plain TLS, which authenticates no one, and the non-PAM branch of onPostConnect() returned true, assuming NLA had already checked the user against the generated SAM file. The fix ties TLS to PAM mode (FreeRDP_TlsSecurity = usePamAuthentication), leaving the custom-user path NLA-only. Commit 9986a6a9, shipped in Plasma 6.8.1.

Fix Merge request

Weston2026Wayland

Weston could be configured to require a credential and quietly stop asking for one. Its RDP backend turned on NLA only if its user database was there at startup. A missing file, a typo or a relative path resolved from the wrong directory dropped it to TLS alone, which encrypts the connection but authenticates nobody, and the only sign was a line in a debug log.

backend-rdp set nla_enabled only when access(nla_ntlm_db, F_OK) succeeded; otherwise it logged to the rdp-backend debug scope and carried on with TLS-only security. The fix makes an inaccessible database a startup error at the default log level and fails backend creation. Commit 8230dd69, released in Weston 16.0.2. The check still tests only that the path exists, not what the file contains.

Fix Release

underc0ver2020

My school's Chromebooks ran IMTLazarus, a monitoring extension. I found a way past it onto an internet that was neither watched nor filtered, reported it, and the vendor fixed it.

The extension's permissions matched only http and https pages, so a local page opened under another URL scheme was never inspected. I reported it to IMTLazarus and the vendor fixed it.

Fake mute2021

An experiment with a known technique. A Discord user could appear muted while still speaking, or deafened while still listening.

An experiment with a known technique. I monkey-patched the client's WebSocket to rewrite its voice-state payload, and Discord took the state it was sent at its word.

Aurax

E-commerce and marketing company

Role: Co-founder and CTO
When: 2023 to 2025

Aurax was a company I co-founded and ran as its CTO from 2023 to 2025, while studying for the International Baccalaureate. At its peak it had several branches: e-commerce under our own brands, with a custom logistics pipeline and warehouses in Europe, Asia and America, much of it outsourced; a marketing agency; and a web design and development studio. We incorporated it in the United States, grew from three people to about eight, and reached six figures a year in revenue.

I managed most of our operations, which is what let me build internal tools that saved us time and shortened our timelines. My own specialty was website design, SEO, technical architecture, integrations, UX and conversion-rate optimization, which I put into the dozens of stores I built myself.

One of those tools, made late in 2023 before AI agents were common, turned a product into a finished Shopify page for our own stores. It wrote the copy, laid out the page and picked stock images, leaving one of us only to review it, and it let us build hundreds of stores instead of dozens.

Our quotes came from another system I built, as the first step of client onboarding. Given a short brief, it matched what the client needed to our services and their prices, and Claude turned that into a full proposal: a small website, in a design system I had made, that even quoted the right price on the first try most of the time.

I also started a marketing intelligence tool that read what Facebook ads were showing and inferred the data points a media buyer needs to plan a campaign. It didn’t reach production, because it was more than a team our size could carry.

Todos por Venezuela

Earthquake relief site

When: 2026
Link: todosporvenezuela.org

After the earthquakes in Venezuela in June 2026, a group of young Venezuelans organised to take medical supplies, food and water to the families hit hardest. They needed a place to explain themselves and to be trusted with money. I designed and built it in a rush, in about 12 hours when it happened, as a volunteer. I also pay for what it costs to run.

The Spanish hero, captured 6 October 2026, cropped below the fundraising progress.

The site is in Spanish and English. It introduces the organisers, takes donations, and shows where things stand, with transparency reports alongside. I built the donation flow so that each PayPal notification is verified before it counts, and the same payment can’t be counted twice.

Each PayPal notification is posted back to PayPal, and only an exact VERIFIED reply is accepted. It must then be completed, in the right currency, for the right item, with a transaction id and an amount above zero. One Redis Lua script records the transaction id only if it is new and adds to the total in the same step, so PayPal’s retries can’t count a payment twice. If saving fails, the endpoint answers 500 and PayPal tries again.

If Redis can’t be read, the site shows its last baseline figure and marks it as a fallback. The total updates live over a stream that closes after 25 seconds, and the browser falls back to polling every 15. Previews run against PayPal’s sandbox with writes off and keys of their own.

The relief work is theirs. Mine was making it easy to understand and to support.

Still

Twitch frontend

When: 2026
Links: notwitch.tv Source on GitHub

Still is a fast, anonymous frontend for Twitch that I built and run at notwitch.tv. About a thousand people use it every day to watch live streams and past broadcasts without an account, ads or anything to install.

Still is a fast, anonymous frontend for Twitch that I built and run at notwitch.tv. It has about 1K DAU.

Still's player beside live chat, from the project's own screenshots of October 2026.

It aims to be a better way to watch Twitch: anonymous, without ads, and with features viewers have asked Twitch for. You can rewind a stream that is still live, and past broadcasts limited to subscribers still play.

It aims at better UX than Twitch’s own: anonymous, without ads, and with features viewers have asked Twitch for. A stream that is still live can be rewound, and past broadcasts limited to subscribers still play.

Live playback reads the low-latency segments Twitch sends ahead as their bytes arrive, drops the ads Twitch stitches into the stream, and adjusts speed between 0.97 and 1.03 times to stay near the live edge. In my tests it ran about 1.9 seconds behind live, against about 2.8 on Twitch’s own player.

When Twitch doesn’t list a live stream’s recording yet, Still finds it anyway. The recording’s folder is named after a hash of the channel, the stream and its start time, so Still rebuilds that name, trying start times up to 30 seconds either side of the reported one, and the stream can be rewound to its beginning.

Past broadcasts load straight from Twitch’s video CDN, without a playback token, from the folder their seek-preview images point to. Twitch won’t describe the qualities of a subscriber-only video, so for those Still opens the source quality first instead of guessing.

Live chat and synchronized chat replay sit alongside playback. Your watch history, playback position and preferences stay in your browser.

Live chat is a read-only IRC connection. Chat replay is fetched by time, 15 seconds ahead of the player, and anything that arrives after a seek is dropped. History, resume positions and preferences stay in localStorage, so there is no account to keep them in.

Still is part of Phantom Media, a set of focused media tools.

Axial

Minecraft launcher

When: 2026
Links: axial.run Source on GitHub

Axial is a Minecraft launcher I’m building in my free time, for vanilla and modded play. It puts the player before the game: it takes care of the performance and compatibility problems other launchers leave to them, and aims for the best interface of any launcher.

It is built for first-time players and expert ones at once. Every setting is there, but the everyday screens show only what most people need, and the rest stays one step away.

Each instance inherits the global settings until one is changed there, which marks it with a chip that resets it. Options that don’t fit an instance, such as a garbage collector its Java can’t run, stay listed but disabled, with the reason.

It installs Fabric, Quilt, Forge and NeoForge, finds or downloads the Java runtime each version needs, and tunes memory, garbage collection and a set of performance mods for each instance.

Each instance gets a garbage collector chosen for its version, loader and machine, from G1 with 15 ms pauses for 1.8.9 PvP to generational ZGC for vanilla on Java 21 and up. Its performance mods come from Modrinth, pinned and checked against their hashes, and if the full set doesn’t fit an instance’s own mods, Axial falls back to a smaller one.

Forge’s installer checks the hashes of the files it builds, and on systems that use zlib-ng they never match. Axial rebuilds only those archives with the classic zlib, so Forge accepts them.

I recently rewrote it from scratch to clear out code that had tangled while I built Guardian, a layer that recovers failed starts. Guardian is back on the roadmap, and I plan to release Axial for free, because the community has no good launcher.

Sentinel

Discord safety service

When: 2024 to 2026

Sentinel is a safety service for Discord that I built to understand messages in context while keeping as little of them as possible. Before judging anything, it works out who is speaking and who a message is aimed at.

It keeps a rolling context for each speaker and works out who a message is aimed at before judging it. People are stored as HMAC pseudonyms rather than their Discord ids, and as little raw text as possible is kept.

Known scams take a fixed, deterministic route. Where a model is involved, it returns structured output, and the assessment stays separate from any action. Automatic action is reserved for narrow, high-confidence cases, and the service supports human review.

Known scams and images take deterministic routes, with no model involved. Where a model is used it has to answer in a fixed schema, its assessment is stored apart from any action, and actions are delivered transactionally. Automatic action is reserved for narrow, high-confidence cases, and the rest goes to human review. I tested it on simulated conversations before the limited pilot.

GW

Minecraft and Discord community

Role: Co-founder
When: 2020 to 2024
Links: MiaUtilidades ModerationDocs

GW was a Spanish-speaking Minecraft and Discord community I co-founded at thirteen with Capitán Gato. His audience launched it, and the community itself carried much of its later growth, to about 500,000 members between 2020 and 2024. I managed the Discord community, largely on my own.

I designed and wrote its entire moderation system: how sanctions were decided and recorded, how apprentices were trained, and the staff’s incentives. Most of it had no precedent to follow, and it shifted many of the trends in Spanish-speaking Discord moderation.

Every sanction went on a fixed record with its case number and evidence, and penalties escalated with severity and repetition.

We built many bots of our own, for defense against raids and server attacks, monitoring, automated moderation, and community features such as an economy. Their filters grew into increasingly advanced regular expressions, and in 2023 we replaced them with the first version of Sentinel, built on AI classifiers.

I ran recruiting myself over several rounds, and designed the filters, interviews and trial periods that turned thousands of applicants into a stable staff of about 30, and up to 50 at its peak. I later managed to delegate both recruiting and supervision, so the team no longer depended on me.

I also built the first version of the Minecraft server: the proxy, load balancing, authentication and security, with regular penetration tests against it. I then put a team together to run it, and it became far more professional. It averaged more than 300 concurrent players at peak hours and reached about a thousand, and we kept it running through the scaling problems that came with that.

The most serious reports, in a community whose members were often very young, were my responsibility. I learned due process with Discord and law enforcement agencies in several countries, which taught became the experiential foundation of my later OPVIM.

During those years Discord accepted me into its Moderator Mentorship Community. Admission required moderating a large server as a teen, passing the Discord Moderator Academy exam and vetting by Discord staff, and fewer than 400 moderators were ever accepted. Through it I trained with Crisis Text Line to support people in crisis, and volunteered with them for a month. The program’s badge is still on my Discord profile.

What I kept from GW is that to learn something and do it well, you have to be able to teach it to someone else.

<h1>Mateo