I build and harden the tools I actually run: AI agent workflows in Go and Python, game mods in Lua. Self-taught from electrical and trades work into security research and systems tooling. When a tool I depend on breaks, I root-cause it and send a tested fix upstream instead of working around it forever.

• ai-trinity — core project. The three things that make an AI coding setup actually reliable: a model that isn't dumb, a real harness, persistent memory. Problem → thesis → buildable solution, EN/DE, from months of hands-on iteration rather than theory.
• schroedinger-sync — single Go binary that exports your claude.ai conversations, project docs and memory to local Markdown. Windows, DPAPI + CDP, no telemetry, no cloud. Now under KeilerHirsch-Labs.
• claude-bordcomputer-sounds — Star-Trek ship's-computer acoustic hooks for Claude Code auto-mode workflows.

Tested patches and root-caused reports against code I run — no drive-by issues.

• MemPalace/mempalace — my daily long-term memory store. Three merged fixes, all found by running it under real load: MCP startup deadlock (#1987), cross-device rename breaking in-place archive repair (#1945), and a miner flooding the store with raw tool dumps (#2010).
• Farming Simulator 25 mods — dedicated-server bugs from a live multiplayer server, submitted as patches with reproduction and log evidence attached: Courseplay · AutoDrive · EnhancedVehicle · BetterContracts · RedTape · ToolInclinationHelper · UnloadBalesEarly
• Dude23-mods/FS25_Personnel_Management — server-freeze (unbounded network array reads) and fail-open farm-authorization bugs. No license on the repo, so reported via Issue — fixed and credited by name twice in the maintainer's v1.1.0.0 notes.

I review PRs the way I ship code: trace the fix to where it's consumed, don't just read the diff, check the discussion thread before adding to it. 12 PRs reviewed across 10 FS25 modding repos: 8 approved, 3 flagged with concrete findings, 1 changes-requested.

• RealisticWeather#170 — swapped self/superFunc parameters that would have crashed on every savegame load, proven against the codebase's own calling convention.
• AutoDrive#544 — read the thread first: the change reintroduced a deliberately-fixed regression; backed the maintainers' call with a concrete alternative.
• ContractBoost#122 — likely nil-crash on a disabled game feature's UI menu.
• ContractBoost#115 — hardcoded engine constant nobody had verified against the base game.

My proving ground: a real dedicated server, real multiplayer, real players hitting real bugs. Multiplayer is where sloppy code actually breaks — honest training for the security work.

• FS25_IronHorseRealism — modular vehicle-realism framework.
• FS25_16xMapFix — verified fix for the 16x-map "freezes at 100% compiling shaders" bug.
• FS25_AutoVRAMOptimizer — auto-raises the texture-streaming VRAM budget to match your card.
• FS25_NoResetMP — hardcore multiplayer: no free vehicle "reset to shop".
• FS25_SoundOverhaulRealism — engine-accurate vehicle sounds (I6/V8), strictly CC0 / self-recorded.
• fs25-server-watch — zero-dependency dedicated server monitor: live status, joins, crashes.

• reach-a-human — bypasses AI customer-service bots to reach a real human, and documents GDPR/CCPA rights when companies hide behind automation.

I hunt bugs in code I actually run — game mods, AI tooling, agent CLIs — and report tested patches, not drive-by issues.

• Recurring multiplayer vuln class across 5 independent FS25 mod authors: server-authoritative network events missing the origin check their siblings have, letting a modified client spoof fake server messages and overwrite protected state. 7 issues filed — economy exploits (forged invoices, unlimited money, forged crop quality in MoistureSystem), a cross-farm exploit with crash vector in EnhancedAnimalSystem, and an unbounded-read DoS.
• Server-freeze + fail-open farm-authorization in a mod — fixed and credited by name twice in the maintainer's release notes.
• Dedicated-server crash and data-loss bug in two other mods — root-caused by bisecting live server and client logs, submitted as PRs.
• Gen-5 audit + model pinning — measured, independently fact-checked evidence on Claude generation 5 (nonsense detection, verbosity, under-disclosed model fallback) and on silent model-pinning bypasses in an agent CLI, with reproducible protocols: full write-up · pinning reproduction protocol v2 · issue #83795.

Coordinated disclosure only. No public details before a fix ships — and I don't claim other people's CVEs.

"Works on my machine" is not a standard. Every repo here clears the same floor:

• CI on every push — lint and tests, so green means something
• Explicit license — no license means all rights reserved
• Tests before release, not after the bug report
• Adversarial second pass before shipping — its only job is to find what I missed
• Root cause over band-aid — hypothesis → reproduction → evidence → fix
• Measure, never guess — a claim without a number is a hunch wearing a lab coat