Mateo

I've been building software and founding things around it since I was thirteen.

In Madrid. I make products people use every day, and I research how systems and the people on them get attacked, from threat intelligence to, lately, a lot of offensive security.

Work

  1. StillTwitch frontend
  2. AxialMinecraft launcher
  3. Security researchSelected investigations
  4. PervasivityIntelligence infrastructure
  5. OPVIMChild-protection organization
  6. SentinelDiscord safety service
  7. Todos por VenezuelaEarthquake relief site
  8. AuraxE-commerce and marketing company
  9. GWMinecraft and Discord community

Still

Live at notwitch.tv. About 1,000 daily users.2026

notwitch.tvSource on GitHub

Still is a fast, anonymous frontend for Twitch that I built and run at notwitch.tv. About a thousand people use it every day to watch live streams and past broadcasts without an account, ads or anything to install.

Still's player beside live chat, from the project's own screenshots of October 2026.

It aims to be a better way to watch Twitch: anonymous, without ads, and with features viewers have asked Twitch for. You can rewind a stream that is still live, and past broadcasts limited to subscribers still play.

Live

Live playback reads the low-latency segments Twitch sends ahead as their bytes arrive, drops the ads Twitch stitches into the stream, and adjusts speed between 0.97 and 1.03 times to stay near the live edge. In my tests it ran about 1.9 seconds behind live, against about 2.8 on Twitch's own player.

Live rewind

When Twitch doesn't list a live stream's recording yet, Still finds it anyway. The recording's folder is named after a hash of the channel, the stream and its start time, so Still rebuilds that name, trying start times up to 30 seconds either side of the reported one, and the stream can be rewound to its beginning.

Past broadcasts

Past broadcasts load straight from Twitch's video CDN, without a playback token, from the folder their seek-preview images point to. Twitch won't describe the qualities of a subscriber-only video, so for those Still opens the source quality first instead of guessing.

Live chat and synchronized chat replay sit alongside playback. Your watch history, playback position and preferences stay in your browser.

Chat

Live chat is a read-only IRC connection. Chat replay is fetched by time, 15 seconds ahead of the player, and anything that arrives after a seek is dropped. History, resume positions and preferences stay in localStorage, so there is no account to keep them in.

Still is part of Phantom Media, a set of focused media tools.

Axial

In alpha on macOS, Windows and Linux.2026

axial.runSource on GitHub

axum

Axial is a Minecraft launcher I’m building in my free time, for vanilla and modded play. It puts the player before the game: it takes care of the performance and compatibility problems other launchers leave to them, and aims for the best interface of any launcher.

Axial's icon and its home screen.

It is built for first-time players and expert ones at once. Every setting is there, but the everyday screens show only what most people need, and the rest stays one step away.

Settings

Each instance inherits the global settings until one is changed there, which marks it with a chip that resets it. Options that don't fit an instance, such as a garbage collector its Java can't run, stay listed but disabled, with the reason.

It installs Fabric, Quilt, Forge and NeoForge, finds or downloads the Java runtime each version needs, and tunes memory, garbage collection and a set of performance mods for each instance.

Tuning

Each instance gets a garbage collector chosen for its version, loader and machine, from G1 with 15 ms pauses for 1.8.9 PvP to generational ZGC for vanilla on Java 21 and up. Its performance mods come from Modrinth, pinned and checked against their hashes, and if the full set doesn't fit an instance's own mods, Axial falls back to a smaller one.

Forge

Forge's installer checks the hashes of the files it builds, and on systems that use zlib-ng they never match. Axial rebuilds only those archives with the classic zlib, so Forge accepts them.

I recently rewrote it from scratch to clear out code that had tangled while I built Guardian, a layer that recovers failed starts. Guardian is back on the roadmap, and I plan to release Axial for free, because the community has no good launcher.

Security research

Since 2020.

I look for the places where software trusts more than it should. I think a lot about the threats people actually face today. That is why I do offensive security, and why I founded Pervasivity and OPVIM.

Most of my research has stayed private or under coordinated disclosure. Much of it is now coming out, and I add it here as it does.

Selected investigations

  • 2020underc0verMy school's Chromebooks ran IMTLazarus, a monitoring extension. I found a way past it onto an internet that was neither watched nor filtered, reported it, and the vendor fixed it.Write-up
  • 2021Fake muteAn experiment with a known technique. A Discord user could appear muted while still speaking, or deafened while still listening.Script
  • 2026KRdpKDE PlasmaKRdp, Plasma's remote desktop server, asked for a password only on the route it expected a client to take. With a custom user list it offered TLS alongside NLA, and a client that picked TLS walked straight in, because the check after connecting assumed NLA had already verified the user. Anyone who could reach the port could open the desktop without a credential. I reported it four days before Plasma 6.8.1 shipped, and the fix went out in that release.FixMerge request
  • 2026WestonWaylandWeston could be configured to require a credential and quietly stop asking for one. Its RDP backend turned on NLA only if its user database was there at startup. A missing file, a typo or a relative path resolved from the wrong directory dropped it to TLS alone, which encrypts the connection but authenticates nobody, and the only sign was a line in a debug log.FixRelease

Pervasivity

Deployed intelligence infrastructure.2026

Pervasivity is intelligence infrastructure I build and run. The work starts with understanding how external platforms operate, then turning that protocol research into software that can be used in a specific operational context.

One workspace in its repository looks things up in public sources, preserves each observation as an immutable snapshot, and checks again on a schedule. It separates what was observed from what was inferred and makes changes reviewable over time. The difficult decisions concern provenance, durable state and how external protocols change.

A lookupRequestIdempotency keyJob leaseSnapshotHistorySearch

Each lookup is a job with an idempotency key, so asking twice does the work once, and it runs under a lease, so a worker that stops hands the job back instead of leaving it half done. What it finds is written as an immutable snapshot, and history and search read from snapshots, not from the live source.

It is deployed, and OPVIM uses a custom implementation for its operations. That application is part of the story, alongside the underlying research. Phantom Media also began in this repository before becoming a separate family of products.

OPVIM

Founder and director. Early stage.2026

Public website

OPVIM, the Observatorio de Protección frente a la Violencia en Internet contra Menores (OPMOV in English), is an organization I founded and direct to protect minors in Spanish-speaking online spaces. It grew out of the reports I handled at GW.

OPVIM's public identity and its operational foundation. The relationship is illustrated; no operational interface or data is shown.

It is at an early stage. I run it on my own, with external collaborators and, when a case calls for it, law enforcement. For now it monitors, builds its technology and reports every finding privately through channels that law enforcement provides. Research and publications are due to begin by the end of 2026.

Its operations run on Pervasivity, the intelligence system I built for it. It collects from our own sources and tracks all of them continuously for changes, much as Palantir’s platforms do.

OperationsOwn sourcesPervasivityPrivate reports to law enforcement

In June 2026, during the earthquakes in Venezuela, I worked informally to monitor and find missing children, and to make sure they were safe and cared for.

I also designed its identity and Spanish-language website, built around the line Hay vidas detrás de cada pantalla: there are lives behind every screen.

Sentinel

Research with a limited pilot.2024 to 2026

BullMQ

Sentinel is a safety service for Discord that I built to understand messages in context while keeping as little of them as possible. Before judging anything, it works out who is speaking and who a message is aimed at.

PseudonymsspeakerHMACea54e8a9ef60targetHMAC3c52240fc718

It keeps a rolling context for each speaker and works out who a message is aimed at before judging it. People are stored as HMAC pseudonyms rather than their Discord ids, and as little raw text as possible is kept.

Known scams take a fixed, deterministic route. Where a model is involved, it returns structured output, and the assessment stays separate from any action. Automatic action is reserved for narrow, high-confidence cases, and the service supports human review.

MessageKnown scamFixed routeModelStructured outputAction

Known scams and images take deterministic routes, with no model involved. Where a model is used it has to answer in a fixed schema, its assessment is stored apart from any action, and actions are delivered transactionally. Automatic action is reserved for narrow, high-confidence cases, and the rest goes to human review. I tested it on simulated conversations before the limited pilot.

Todos por Venezuela

Live. Volunteer work, June 2026.

todosporvenezuela.org

After the earthquakes in Venezuela in June 2026, a group of young Venezuelans organised to take medical supplies, food and water to the families hit hardest. They needed a place to explain themselves and to be trusted with money. I designed and built it in a rush, in about 12 hours when it happened, as a volunteer. I also pay for what it costs to run.

The Spanish hero, captured 6 October 2026, cropped below the fundraising progress.

The site is in Spanish and English. It introduces the organisers, takes donations, and shows where things stand, with transparency reports alongside. I built the donation flow so that each PayPal notification is verified before it counts, and the same payment can’t be counted twice.

A donationPayPal notificationVerifyCompletedReceiverCurrencyCount once

Each PayPal notification is posted back to PayPal, and only an exact VERIFIED reply is accepted. It must then be completed, in the right currency, for the right item, with a transaction id and an amount above zero. One Redis Lua script records the transaction id only if it is new and adds to the total in the same step, so PayPal's retries can't count a payment twice. If saving fails, the endpoint answers 500 and PayPal tries again.

When something fails

If Redis can't be read, the site shows its last baseline figure and marks it as a fallback. The total updates live over a stream that closes after 25 seconds, and the browser falls back to polling every 15. Previews run against PayPal's sandbox with writes off and keys of their own.

The relief work is theirs. Mine was making it easy to understand and to support.

Aurax

Co-founder and CTO, 2023 to 2025. Six figures in annual revenue.

Aurax was a company I co-founded and ran as its CTO from 2023 to 2025, while studying for the International Baccalaureate. At its peak it had several branches: e-commerce under our own brands, with a custom logistics pipeline and warehouses in Europe, Asia and America, much of it outsourced; a marketing agency; and a web design and development studio. We incorporated it in the United States, grew from three people to about eight, and reached six figures a year in revenue.

I managed most of our operations, which is what let me build internal tools that saved us time and shortened our timelines. My own specialty was website design, SEO, technical architecture, integrations, UX and conversion-rate optimization, which I put into the dozens of stores I built myself.

One of those tools, made late in 2023 before AI agents were common, turned a product into a finished Shopify page for our own stores. It wrote the copy, laid out the page and picked stock images, leaving one of us only to review it, and it let us build hundreds of stores instead of dozens.

Our quotes came from another system I built, as the first step of client onboarding. Given a short brief, it matched what the client needed to our services and their prices, and Claude turned that into a full proposal: a small website, in a design system I had made, that even quoted the right price on the first try most of the time.

I also started a marketing intelligence tool that read what Facebook ads were showing and inferred the data points a media buyer needs to plan a campaign. It didn’t reach production, because it was more than a team our size could carry.

GW

Co-founder at 13, 2020 to 2024. About 500,000 members.

MiaUtilidadesserver toolingModerationDocsstaff guidance

GW was a Spanish-speaking Minecraft and Discord community I co-founded at thirteen with Capitán Gato. His audience launched it, and the community itself carried much of its later growth, to about 500,000 members between 2020 and 2024. I managed the Discord community, largely on my own.

I designed and wrote its entire moderation system: how sanctions were decided and recorded, how apprentices were trained, and the staff’s promotions and incentives. Most of it had no precedent to follow, and it shifted many of the trends in Spanish-speaking Discord moderation.

The staff system

Every sanction went on a fixed record with its case number and evidence, and penalties escalated with severity and repetition.

The bots

We built many bots of our own, for defense against raids and server attacks, monitoring, automated moderation, and community features such as an economy. Their filters grew into increasingly advanced regular expressions, and in 2023 we replaced them with the first version of Sentinel, built on AI classifiers.

I ran recruiting myself over several rounds, and designed the filters, interviews and trial periods that turned thousands of applicants into a stable staff of about 30, and up to 50 at its peak. I later managed to delegate both recruiting and supervision, so the team no longer depended on me.

I also built the first version of the Minecraft server: the proxy, load balancing, authentication and security, with regular penetration tests against it. I then put a team together to run it, and it became far more professional. It averaged more than 300 concurrent players at peak hours and reached about a thousand at times, and we kept it running through the scaling problems that came with that.

The most serious reports, in a community whose members were often very young, were my responsibility, and I handled them myself. I took them to Discord and to law enforcement agencies in several countries, which involved international law. That experience became the foundation of OPVIM.

During those years Discord accepted me into its Moderator Mentorship Community. Admission required moderating a large server as a teen, passing the Discord Moderator Academy exam and vetting by Discord staff, and fewer than 400 moderators were ever accepted. Through it I trained with Crisis Text Line to support people in crisis, and volunteered with them for a month. The program’s badge is still on my Discord profile.

What I kept from GW is that to learn something and do it well, you have to be able to teach it to someone else.

About

In Madrid. I make products people use every day, and I research how systems and the people on them get attacked, from threat intelligence to, lately, a lot of offensive security.

hi@mateorb.comGitHub

axumBullMQ

Most of what I know came from running things. At thirteen I co-founded a community that grew to about 500,000 people. During the International Baccalaureate I co-founded a business that reached six figures in revenue. In 2026 I founded an organization that protects minors online.

Every tool I built there had someone on the other end of it, and that's still where I start: first the person who has to live with the software, then the system underneath.

I'm self-taught, and an alumnus of Discord's Moderator Programs.

Email

Write it here and it opens in your own mail app, ready to send.

ToMateo hi@mateorb.com

The suggestions are worked out in your browser, from what you've written and what's on this site. Nothing you write leaves it until you send.