Security researcher · AI security & agent engineering · Reverse engineer · Norway 🇳🇴
Decepticon ↗ · hashward ↗ · BitterSecurity ↗ · X ↗ · TryHackMe ↗
About · Now · Projects · Contributions · Toolchain · Activity · Contact
I'm NetVar — founder of hashward and co-founder of BitterSecurity. I build autonomous offensive-security agents and the reverse-engineering tooling and agent infrastructure behind them: software that finds, verifies, and explains vulnerabilities on real systems, within an authorized scope.
- 🥈 #2 all-time contributor to Decepticon — an autonomous red-team agent with 6.5k★, where I've landed 400+ commits.
- 🤝 26 merged PRs to other people's projects, including Anthropic's claude-code-action, x64dbg, Serena, and 8 feature PRs to the Recurse RE IDE.
- 🔩 Full-stack low-level work — Windows kernel-driver emulation, Linux kernel patches, PCIe/NVMe HDL, and IDA / Ghidra / x64dbg tooling.
- 🟢 Open to security research, vulnerability research, and AI security roles — reach me on X or via hashward.io.
- Building Decepticon and hashward — autonomous offensive-security agents and the RE tooling behind them.
- Maintaining KEVLAR, omniwire and mcp-ctl — kernel-driver emulation and agent infrastructure.
- Landing upstream PRs (Recurse, PCILeechGen, x64dbg, oh-my-pi, …) and publishing audit playbooks via audit-findings-skills.
| Project | Stars | What it is |
|---|---|---|
| Decepticon | Autonomous hacking agent for authorized red-team operations. Core contributor (#2, 400+ commits). | |
| Vigilo | AI hacker for Web3 smart contracts — built for bug bounties and audit contests. | |
| PurpleAILAB | Agentic cybersecurity harness, with its site and knowledge vault. | |
| AutoBot | Autonomous defense agent for the blue team. | |
| Cybertron | Autonomous security-intelligence agent. |
| Project | What it is |
|---|---|
| KEVLAR | Windows x64 kernel-driver emulation and behaviour analysis, built on Unicorn + Zydis. |
| AiDA | Native C++ AI-assistant plugin for IDA Pro 9.x. |
| audit-findings-skills | 23,625 smart-contract audit findings distilled into reusable review playbooks. |
| linux-rk3576-rocket | RFC patch series adding RK3576 support to the mainline Linux Rocket NPU driver. |
| Project | Stars | What it is |
|---|---|---|
| claude-for-firefox | Community Firefox extension: Claude in the sidebar, with chat and browser automation. | |
| omniwire | Infrastructure for AI agent swarms — 88 MCP tools, A2A, mesh VPN, CDP browser. | |
| mcp-ctl | Zero-intervention MCP lifecycle manager for every AI CLI, written in Zig. |
Merged upstream work — all merged PRs ↗
| Project | Merged PRs | Highlights |
|---|---|---|
| Recurse-Labs/recurse | 8 | Decompiler, symbolic execution, MCP server and Python bindings; VTIL-inspired de-virtualization IL; multi-provider AI auth; signed auto-update |
| sercanarga/PCILeechGen | 9 | NVMe admin/IO queue emulation in HDL, PRP2 page-crossing, offline mmiotrace import, VFIO diagnostics tests |
| can1357/oh-my-pi | 3 | MCP stdio broken-pipe handling, Ollama 5xx retries and history sanitising |
| anthropics/claude-code-action | 1 | Fix claude_args parsing of shell comment lines |
| x64dbg/x64dbg | 1 | macOS cross-build in CI |
| oraios/serena | 1 | Detect rust-analyzer from PATH without rustup |
| sinnafuls/enma-lsp | 1 | LSP feature-set expansion |
Latest merged pull requests outside my own repos — refreshed daily by GitHub Actions.
- Pharaoh2k/ps4debug-NG#3 — PROTOCOL.md: fix reg64 size, fw encoding, fpu size · 2026-11-12
- can1357/oh-my-pi#18465 — fix(tui): hold a relayed win32 OSC/DCS/APC string until its terminator · 2026-11-08
- Recurse-Labs/recurse#7 — feat: in-app auto-update, quick-install scripts, and signed release pipeline · 2026-10-29
- x64dbg/x64dbg#4003 — cross: build on macOS in CI · 2026-10-28
- BitterSecurity/Decepticon#1112 — test: measure core/SDK coverage and add core-SDK re-export contract test · 2026-10-26
- BitterSecurity/docs#3 — ci: local docs checks (mintlify validate + broken-links + EN/KO parity), optional Actions workflow · 2026-10-26
🛡️ Detection research — anti-cheat & account abuse
| Project | What it is |
|---|---|
| account-security | Account takeover, credential stuffing, session and inventory abuse detection for game platforms — graph-based analysis. |
| cheat-intel | Cheat-community intelligence: monitoring methodology, trend reporting, and the intel → detection feedback loop. |
| apex-anticheat-lab | FPS anti-cheat lab — runnable synthetic fixtures, cohort-aware baselines, explainable scores. |
These are independent research projects, not evidence of production deployment or employment with a game studio or anti-cheat vendor. The lab uses synthetic data, and its YARA sketches are not operational detection rules.
🔧 Hardware & embedded
flipctld — menu-UI core for Flipper One (JSON manifests, D-pad navigation, ANSI + framebuffer)
flipper-profile — btrfs + overlayfs snapshot profiles for Flipper One
PCILeechGen contributions — PCIe / NVMe device emulation in HDL
|
Reverse engineering IDA Pro 9.x + IDAPython · Ghidra · x64dbg · radare2 · Unicorn · Zydis · Capstone · YARA · LIEF Offensive security Autonomous red-team agents · fuzzing · kernel-driver analysis · smart-contract auditing |
AI & agents MCP (Model Context Protocol) · A2A · agent swarms · Playwright / CDP · Claude Code · Codex CLI Low-level & hardware Linux kernel · eBPF · PCIe / NVMe HDL · Flipper One · RP2350 · embedded firmware · USB protocol work |
| 01 / Scope | 02 / Evidence | 03 / Disclosure |
|---|---|---|
| Test only within an explicitly authorized scope, starting from the threat model. | Every finding ships with a reproducible proof and its limitations stated. | Report responsibly, and turn the lesson into tooling others can inspect. |
Open to security research, vulnerability research, and AI security roles.
| Channel | Link |
|---|---|
| X / Twitter | @NetVar1337 ↗ — fastest way to reach me |
| Company | hashward.io ↗ |
| Product | decepticon.red ↗ |
| CTF profile | TryHackMe ↗ |
| Support the work | Sponsor on GitHub ↗ |
Build openly. Think adversarially. Verify the evidence.