I build the systems that have to survive real players.

Finding the weak point first

When I started university, I found vulnerabilities in the school’s website and walked the administrator through them so they could be fixed. I didn’t touch anything. I just showed them.

That’s still how I work. On a live server, players hunt for exploits every day, so I read a system the way an attacker would, then close the gaps before anyone else finds them. CTFs keep that instinct sharp, and I’m building Luminol, a deobfuscator for auditing Garry’s Mod addons.

How I hardened a live economy →

Found, fixed and shipped

• Players could duplicate items through a timing gap in crate pickups. Items are now reserved before the asynchronous work and refunded on failure.
• Networked event data revealed enough to cheat a live PvP event. Fixed with a patch built to go onto the live server straight away.
• A fingerprint card’s hidden data could be edited from the client. Edits now only accept known fields and are stored on the server.
• The server accepted a faction ID sent by the client when moving characters between factions. It now checks the ID against its own data.
• Record edits only accept IDs the server already showed that player, so changing an ID in the request does nothing.
• An exploit through a context-menu action removed weapon recoil. Closed.

Long-term, not hourly. A full-time role on a security or architecture team, or a retainer with a set number of hours each month: either way, a relationship that lasts years and a steady variety of problems to own.

Care for a sapling and it bears fruit for longer than your life. I work the same way: I’d rather own your systems for years than put out one fire and leave. Someone on your side owns the requirements; I own the architecture, the build and keeping it healthy.

You see progress as it happens, not only at the end, and once there’s trust, the process gets lighter. Work is remote and asynchronous by default, and I’m open to relocating if the employer covers the move. I use AI the way a senior engineer should: I design and direct, it speeds up the build. I don’t take hourly gigs or unpaid trials.

Who I work with

• Game security and anti-cheat teams, and AppSec and security engineering teams that want an architect who thinks like an attacker.
• CTOs and founders at game studios and game-tech companies with real customers and systems that have to hold up.
• Security companies that need a builder with a hacker’s instinct.
• Owners of large multiplayer platforms and servers who want a long-term architect.
• German-speaking teams: I grew up bilingual in German.

Beyond the code

Servers, economies, security and people are all systems, and I’m most curious about why they break the way they do. Code is how I make a living. Understanding that is what I keep coming back to.

I’m looking for a team or a client I can stay with for the long run, not a stopgap: somewhere the problems keep getting harder and the systems are worth protecting.

I was born in Germany and grew up in Serbia, bilingual in Serbian and German from childhood. English is my strongest working language, and I’m learning French. Outside work I read and think about mathematics, philosophy and psychology.