Security researcher · AI security & agent engineering · Reverse engineer · Norway 🇳🇴
Decepticon ↗ · hashward ↗ · BitterSecurity ↗ · X ↗ · TryHackMe ↗
I'm NetVar — founder of hashward and co-founder of BitterSecurity. I build autonomous offensive-security agents and the reverse-engineering tooling and agent infrastructure behind them: software that finds, verifies, and explains vulnerabilities on real systems, within an authorized scope.
- 🥈 #2 all-time contributor to Decepticon — an autonomous red-team agent with 6.5k★, where I've landed 400+ commits.
- 🤝 26 merged PRs to other people's projects, including Anthropic's claude-code-action, x64dbg, Serena, and 8 feature PRs to the Recurse RE IDE.
- 🔩 Full-stack low-level work — Windows kernel-driver emulation, Linux kernel patches, PCIe/NVMe HDL, and IDA / Ghidra / x64dbg tooling.
- 🟢 Open to security research, vulnerability research, and AI security roles — reach me on X or via hashward.io.
| Project | Stars | What it is |
|---|---|---|
| Decepticon |  |
Autonomous hacking agent for authorized red-team operations. Core contributor (#2, 400+ commits). |
| Vigilo |  |
AI hacker for Web3 smart contracts — built for bug bounties and audit contests. |
| PurpleAILAB |  |
Agentic cybersecurity harness, with its site and knowledge vault. |
| AutoBot |  |
Autonomous defense agent for the blue team. |
| Cybertron |  |
Autonomous security-intelligence agent. |
| Project | What it is |
|---|---|
| KEVLAR | Windows x64 kernel-driver emulation and behaviour analysis, built on Unicorn + Zydis. |
| AiDA | Native C++ AI-assistant plugin for IDA Pro 9.x. |
| audit-findings-skills | 23,625 smart-contract audit findings distilled into reusable review playbooks. |
| linux-rk3576-rocket | RFC patch series adding RK3576 support to the mainline Linux Rocket NPU driver. |
| Project | Stars | What it is |
|---|---|---|
| claude-for-firefox |  |
Community Firefox extension: Claude in the sidebar, with chat and browser automation. |
| omniwire |  |
Infrastructure for AI agent swarms — 88 MCP tools, A2A, mesh VPN, CDP browser. |
| mcp-ctl |  |
Zero-intervention MCP lifecycle manager for every AI CLI, written in Zig. |
Merged upstream work — all merged PRs ↗
| Project | Merged PRs | Highlights |
|---|---|---|
| Recurse-Labs/recurse | 8 | Decompiler, symbolic execution, MCP server and Python bindings; VTIL-inspired de-virtualization IL; multi-provider AI auth; signed auto-update |
| sercanarga/PCILeechGen | 9 | NVMe admin/IO queue emulation in HDL, PRP2 page-crossing, offline mmiotrace import, VFIO diagnostics tests |
| can1357/oh-my-pi | 3 | MCP stdio broken-pipe handling, Ollama 5xx retries and history sanitising |
| anthropics/claude-code-action | 1 | Fix claude_args parsing of shell comment lines |
| x64dbg/x64dbg | 1 | macOS cross-build in CI |
| oraios/serena | 1 | Detect rust-analyzer from PATH without rustup |
| sinnafuls/enma-lsp | 1 | LSP feature-set expansion |
Latest merged pull requests outside my own repos — refreshed daily by GitHub Actions.
- Recurse-Labs/recurse#7 — feat: in-app auto-update, quick-install scripts, and signed release pipeline · 2026-10-29
- x64dbg/x64dbg#4003 — cross: build on macOS in CI · 2026-10-28
- BitterSecurity/Decepticon#1112 — test: measure core/SDK coverage and add core-SDK re-export contract test · 2026-10-26
- BitterSecurity/docs#3 — ci: local docs checks (mintlify validate + broken-links + EN/KO parity), optional Actions workflow · 2026-10-26
- hashward-io/.github#3 — fix(secret-scan): scan the PR range without an authenticated fetch · 2026-10-21
- BitterSecurity/Decepticon#995 — feat(llm): optional vendor-neutral OpenAI-compatible gateway · 2026-10-17
🛡️ Detection research — anti-cheat & account abuse
| Project | What it is |
|---|---|
| account-security | Account takeover, credential stuffing, session and inventory abuse detection for game platforms — graph-based analysis. |
| cheat-intel | Cheat-community intelligence: monitoring methodology, trend reporting, and the intel → detection feedback loop. |
| apex-anticheat-lab | FPS anti-cheat lab — runnable synthetic fixtures, cohort-aware baselines, explainable scores. |
These are independent research projects, not evidence of production deployment or employment with a game studio or anti-cheat vendor. The lab uses synthetic data, and its YARA sketches are not operational detection rules.
🔧 Hardware & embedded
flipctld — menu-UI core for Flipper One (JSON manifests, D-pad navigation, ANSI + framebuffer)
flipper-profile — btrfs + overlayfs snapshot profiles for Flipper One
PCILeechGen contributions — PCIe / NVMe device emulation in HDL
|
Reverse engineering IDA Pro 9.x + IDAPython · Ghidra · x64dbg · radare2 · Unicorn · Zydis · Capstone · YARA · LIEF Offensive security Autonomous red-team agents · fuzzing · kernel-driver analysis · smart-contract auditing |
AI & agents MCP (Model Context Protocol) · A2A · agent swarms · Playwright / CDP · Claude Code · Codex CLI Low-level & hardware Linux kernel · eBPF · PCIe / NVMe HDL · Flipper One · RP2350 · embedded firmware · USB protocol work |
| 01 / Scope | 02 / Evidence | 03 / Disclosure |
|---|---|---|
| Test only within an explicitly authorized scope, starting from the threat model. | Every finding ships with a reproducible proof and its limitations stated. | Report responsibly, and turn the lesson into tooling others can inspect. |
Message me on X ↗ · hashward.io ↗ · decepticon.red ↗
Build openly. Think adversarially. Verify the evidence.