Michael Tot

Game design Cyber security

Building worlds / Defending systems

I build the parts of a game that have to survive real players.

I’m Michael Tot, a systems architect and senior backend engineer. I design server-authoritative backends, player state, economies and the security around them for live multiplayer games.

Twenty years in, mostly in C# and Lua. For the past two years I’ve been the main developer at Diverge Networks, one of the largest Garry’s Mod roleplay communities: over 700 commits, from spec to production. I work remotely on retainer, on one hard problem at a time.

Get in touch See the work 
$ whoami
michael-tot
$ years --since-first-script
20
$ stack --deep
C#, Lua
$ availability
open to retainer contracts
$

How I got here

  1. Age 6

    Started coding, in PAWN, to run my own San Andreas multiplayer server. Self-taught, through the games I played.

  2. Age 11

    First paid contract.

  3. Age 18

    Owned and ran my own game server company, then sold it.

  4. Now

    Thirteen years of GLua and about as many in C#. Main developer at Diverge Networks, working on retainer.

What I build

Backends and live services

Matchmaking, leaderboards, stat tracking, scalable APIs, and server-authoritative state that holds up under real traffic and real cheaters.

Game systems design

Classes, abilities, skill trees, progression, balance, combat, and enemy AI and scaling, for RPGs and ARPGs.

A security instinct

I look for how a system breaks before someone else does. CTFs keep that instinct sharp.

Tools people use

Frameworks and mods with thousands of downloads, including World of Warcraft UI mods and multiplayer community frameworks.

Deep
C#, Lua (GLua)
Also
Python, C++, GDScript, PHP
Engines and platforms
Unity (including ECS modding through IL2CPP, BepInEx and Harmony), Godot, Garry’s Mod (Source), FNA/XNA, Steamworks
Data
PostgreSQL, MySQL, MongoDB
Reverse engineering
Ghidra, IL2CPP games, reading assembly and C

Selected work

Case studies from the past two years as the main developer at Diverge Networks, one of the largest Garry’s Mod roleplay communities. Ember edges mark game systems, cyan edges mark security and infrastructure. Screenshots and footage are being added.

Live

Item integrity and exploit hardening

A zero-loss migration of every player’s vehicle storage, an equipment system that recovers stuck items, and fixes for item duplication and teleport exploits.

Lua (GLua), NutScript, MySQL

Live

Warrants and criminal justice

Arrest warrants, criminal records, felonies, bail and appeals, with Discord and pager integration and server-side checks on every action.

Lua (GLua), MySQL, Discord webhooks

In testing

Brewing, aging and intoxication

A brewing barrel with designer-tuned odds, aging modelled as bell curves over time, and a blood-alcohol model the police can test for.

Lua (GLua)

Live

Faction conflict events

Automated, scheduled PvP events for rival factions, with admin menus, persistent scoring and fair scaling as player numbers change.

Lua (GLua), MySQL

Live

Phone and radio rewrite

A full rebuild of phones, payphones and radios, with calls that always clean up and police channels that stay private.

Lua (GLua)

In testing

Composable speed modifiers

Stackable, named movement modifiers that replaced last-writer-wins speed changes, with a migration path that kept every old plugin working.

Lua (GLua)

Live

Ordered plugin data on MySQL

A per-plugin MySQL queue that guarantees reads never overtake writes, with promises, caching and failure handling built in.

Lua (GLua), MySQL

Retired

Plugin hot reload

A plugin-level hot reload that removed ten-second reload freezes from my workflow for three months, and what I learned retiring it.

Lua (GLua), NutScript internals

In progress and earlier work

In progress

GLua deobfuscator

A C# tool for auditing Garry’s Mod addons: it deobfuscates Lua through a syntax tree and flags suspicious behaviour.

C#, .NET, Loretta (Lua parser)

Released openly

Dojo Arena, a V Rising server mod

A PvP arena mod that ran a public server for six months: my command framework, plus game rules patched into Unity ECS through IL2CPP.

C#, BepInEx, Harmony, Unity ECS

Finding the weak point first

When I started university, I found vulnerabilities in the school’s website and walked the administrator through them so they could be fixed. I didn’t touch anything. I just showed them.

That’s still how I work. I read a system the way an attacker would, then close the gaps before anyone else finds them. CTFs keep that instinct sharp, and I’m building a GLua deobfuscator for auditing addons.

Found, fixed and shipped

  • The server accepted a faction ID sent by the client when moving characters between factions. It now checks the ID against its own data.
  • Players could duplicate items through a timing gap in crate pickups. Items are now reserved before the asynchronous work and refunded on failure.
  • Opening two vehicle trunks at once let players teleport items between them. Only one trunk can be open now.
  • Networked event data revealed enough to cheat a live PvP event. Fixed with a patch that could ship to the live server immediately.
  • An exploit through a context-menu action removed weapon recoil. Closed.
  • Record edits only accept IDs the server already showed that player, so changing an ID in the request does nothing.

How I work

Retainer, not hourly. A set number of hours each month, one hard problem to own, and the freedom to solve it my way.

I’m the person you bring in when something has to be solved by Tuesday. Work happens under a signed contract. I don’t take full-time roles, hourly gigs or unpaid trials.

Who I work with

  • CTOs and founders at game studios and game-tech companies with real customers and hard systems problems.
  • Security companies that need a builder with a hacker’s instinct.
  • Owners of large multiplayer platforms and servers who want a long-term architect.

Beyond the code

Servers, economies, security and people are all systems, and I’m most curious about why they break the way they do. Code is how I make a living. Understanding that is what I keep coming back to.

Next up is formal study of psychology, with psychotherapy as the long-term path. The retainer work I take on now funds that, and leaves me the time to do it properly.

Outside work I read and think about mathematics, philosophy and psychology. I speak Serbian, German and English, and I’m learning French.

Have a hard problem?

Send a short note about the problem and your timeline. I work remotely on Central European Time.

mihailo.silni@gmail.com LinkedIn

References from Diverge Networks available on request.

I am

AI agents are welcome to use this form too. Just pick “An AI agent” above.