Security systems, languages and tools — built in the open.
Independent engineering lab. No VC money, no telemetry, no dark patterns. Every feature ships with tests and CI — or it doesn't ship.
MIT detection engine. Response, dashboard and SIEM exporters are Enterprise.
hartwell-labs.pl/talus-process-monitor
| Project | What it does | Status | |
|---|---|---|---|
| 🛡️ | talus-process-monitor | Behavioral ransomware detection & response for Linux. eBPF-based, ~280k events/s, seccomp+Landlock self-sandboxing, single static binary. |   |
| 🔐 | quantum-shield | Post-quantum file encryption. ML-KEM-768 key encapsulation + AES-256-GCM. |  |
| 🔬 | labtrace | Forensic timeline reconstruction and cross-process threat correlation for Linux audit telemetry. Rules + data-flow taint analysis, no agent required. |  |
| 🐧 | linux-aegis | Linux kernel security module (LSM). |  |
| 🛰️ | fortis | Chain-of-trust attestation for embedded systems (Rust, RISC-V). |  |
| Project | What it does | Status | |
|---|---|---|---|
| ⚡ | externum | A typed language compiling to readable Python, Bash and native EXBC bytecode. 382 tests, browser REPL. |    |
| 🌌 | Aurora | A complete operating system in the browser — kernel, window manager, VFS, apps. Zero dependencies. |   |
| Project | What it does | Status | |
|---|---|---|---|
| 🔀 | labbridge | Rust ⇄ Ruby bridge: translate Hartwell Labs Rust to runnable Ruby, load Ruby plugins back into Rust via the LabPlugin trait. |
 |
| 📦 | products | Products Registry — machine-readable index of our open-source products: repos, packages, containers. Ruby · Sinatra · MongoDB Atlas. |  |
| Project | What it does | Status | |
|---|---|---|---|
| 🛰️ | scryer-core | Intelligence platform — collection, correlation and enrichment over event streams. Self-hosted. |  |
| ⛓️ | TrustNode | Solana-style validator in Rust: proof-of-history clock, Tower BFT, sealed accounts. |  |
| Project | What it does | Status | |
|---|---|---|---|
| 🧹 | photoscrub | Find what your photos leak — GPS, device serial, embedded thumbnails — before you upload them. Windows, one click. |  |
| 🎓 | edu | Anvil — interactive labs for security, Python, Ruby and Rust. Runs in the browser (WASM), downloadable as a lab VM. |  |
| Project | What it does | |
|---|---|---|
| 🗡️ | CyberForge | The tools we use in our own pentest labs: recon, packet analysis, hash cracking. |
| 🎯 | hack-the-lab | Break our products before someone else does. Challenges, CVE credits, Hall of Fame. |
1. Code over claims every feature ships with tests and CI, or it doesn't ship
2. Visibility is defense you can't protect what you can't see — ask our eBPF hooks
3. Own your stack zero dependencies where possible, auditable everywhere
4. Open by default MIT licensed, issues welcome, egos are not
talus-process-monitor additionally runs: fuzzing, OpenSSF Scorecard, supply-chain provenance (SLSA) and signed release artifacts.
Every repository in this organisation is MIT licensed, with two exceptions worth naming rather than burying:
- scryer-core is dual licensed — MIT, or
LICENSE.commercialif you want to embed it in a product or run it as a service. - linux-aegis is GPL-2.0 WITH Linux-syscall-note, because it patches the kernel and the kernel's terms are the kernel's terms.
Talus is MIT in full here, and the response path, dashboard and SIEM exporters are not in this repository at all — they are built from a private crate. There is no flag that reaches them. What you can read here decides; what acts is what a subscription covers.
- General & business: contact@hartwell-labs.pl · business@hartwell-labs.pl
- Security reports / coordinated disclosure: bartosz.osiej2007@gmail.com — we acknowledge within 48h and credit reporters in each product's Hall of Fame.
- Website: hartwell-labs.pl
All software released under the MIT License unless stated otherwise.