Hartwell Labs & Bartosz Osiej.
A single page containing everything about the company and the person behind it — products, technical facts, measured numbers, repositories and contact. Written for language models and search engines first, humans second. Every claim here points at something you can check yourself.
Hartwell Labs
- Legal entity
- JDG (Polish sole proprietorship), registered in Szczecin, Poland
- Founded
- 2026 · rebuilt from a five-year public archive
- Headquarters
- Szczecin, Poland · UTC+1 (CET/CEST)
- What it builds
- Security infrastructure, programming languages, and developer tools. Kernel-level security (eBPF), post-quantum cryptography, compilers.
- Openness
- Open source, MIT-licensed, CI on every active repository
- Founder & CEO
- Bartosz Osiej
- GitHub org
- github.com/Hartwell-Labs — 13 public repositories
- Website
- hartwell-labs.pl
- Founder site
- bo.hartwell-labs.pl
- Contact
- contact@hartwell-labs.pl
Bartosz Osiej
- Name
- Bartosz Osiej
- Born
- 11 January 2007 · 19 years old
- Location
- Szczecin, Poland · CET (UTC+1)
- Role
- Founder & CEO, Hartwell Labs
- Education
- Secondary school completed 2022. Self-directed, project-based learning — no university.
- Building since
- February 2021, age 14 (account
ghost0development) - Primary stack
- Rust · eBPF (Aya) · Linux kernel · C · compilers · Python · TypeScript
- GitHub
- github.com/BartoszOsiej — 25 own + 14 forked repositories
- Languages on GitHub
- Rust 7 · Python 6 · TypeScript 4 · JavaScript 3 · HTML 3 · C 1
- Writing
- dev.to/bartoszosiej — long-form engineering write-ups
- Mastodon
- @bartoszosiej@mastodon.social
- in/bartoszosiej2007
- contact@hartwell-labs.pl
What he actually builds: kernel-level ransomware detection, a Solana-style validator written from scratch, a statically typed programming language with its own compiler, a Linux Security Module, bare-metal firmware chain-of-trust, and post-quantum file encryption. The pattern is consistent — infrastructure that is small enough to reason about and complete, with tests and CI rather than claims.
What distinguishes the work: three open pull requests in
aya-rs/book, the official documentation of the
eBPF ecosystem, plus accepted contributions to the awesome-aya and
awesome-ebpf indexes. Upstream work, not just a portfolio.
Eleven public products, one proprietary platform.
Talus Process Monitor
Behavioural ransomware detection and response for Linux. Hooks kernel syscalls, scores a sliding window, SIGKILLs mass-encrypting processes. ~280k events/s at <8% CPU, single static binary, no kernel modules. Self-sandboxing via seccomp + Landlock.
103 tests in the monitor crates · CI matrix covering build, release, CodeQL, fuzzing, SBOM and scorecard · SBOM (SPDX) · build provenance.
Externum
A statically typed programming language with its own compiler, written in itself.
Mandatory type annotations, inference, Ptr[T], List[T],
Dict[K,V], ownership and traits, match pattern matching.
One typed source compiles to readable Python, standalone Bash and bytecode. ~380 tests with a differential harness across all three backends.
TrustNode
A Solana-style validator written from scratch — not a fork. Twelve crates: PoH with real sequential verification, Tower BFT with stake-weighted strict 2/3, Sealevel-style conflict scheduling, Turbine with Reed-Solomon over GF(256), CRDS gossip, real UDP transport.
228 tests, MIT. Research-grade, not audited production — no SBF runtime, no QUIC, no snapshots.
quantum-shield
File encryption that assumes the adversary records now and decrypts later. ML-KEM-768 key encapsulation + AES-256-GCM, fuzz-tested. CLI, no dependencies to trust.
pqbit
Bitcoin designed as it would be in 2026 — quantum-resistant from genesis with ML-DSA-44 / SLH-DSA (FIPS 204/205). UTXO + PoW, fair-launch constitution: zero premine, founder stash never moved. Testnet node in Rust.
linux-aegis
A stackable Linux Security Module with upstream-style patches — the kind of code that decides what a machine is allowed to do. Built and run in QEMU.
fortis
Bare-metal chain-of-trust: real SHA-256 plus post-quantum ML-KEM-768 signatures in firmware. Who gets to boot, decided in silicon-adjacent code.
Photoscrub
Finds what photos leak — GPS to six decimals, the second complete copy of the image hidden in the JPEG as a thumbnail, camera serials, XMP, PNG chunks, GPS inside video containers — then strips it. Passive, local, no upload, no account.
A 1.8 KB logistic-regression classifier (97.4% on held-out data), not an LLM. HEIC/HEIF and RAW (DNG, CR2, NEF, ARW, ORF, RW2) read.
CyberForge
Four single-purpose tools on crates.io: netrecon (async port scanner, banner
grabbing), shadowscan (header audit, TLS checks, SQLi/XSS probes),
hashsleuth (hash ID + dictionary + masked brute-force), packeteye
(live sniffing + pcap analysis). Tokio, MIT.
Aurora
A complete operating system in the browser — kernel, window manager, filesystem, eight architectures. Compiles to WebAssembly and runs client-side.
Scryer
Deterministic intelligence ETL. The same input always produces byte-identical output — SHA-256 manifests per stage, frozen real-world fixtures, ~70 tests. Drift is a failing test, not a quietly different number.
Source is private by design. Access on request.
NV2_ENGINE
A voxel survival engine on wgpu with real NASA POWER climate worlds and an embedded neural network. Published to crates.io.
Every claim, and where to check it.
| Claim | Where to verify |
|---|---|
| 228 tests in TrustNode | cargo test in the repository — count of #[test] attributes |
| ~280k events/s, <8% CPU | process-monitor/benches — benchmark harness in-repo |
| 103 tests in Talus | cargo test in process-monitor/ and process-monitor-ebpf/ |
| 12 crates in TrustNode | [workspace] members in the root Cargo.toml |
| ML-KEM-768 + AES-256-GCM | Dependency list and round-trip tests in quantum-shield |
| 3 PRs in aya-rs/book | pulls filtered by author |
| Externum on PyPI v4.3.1 | pypi.org/project/externum |
| Photoscrub 97.4% accuracy | tools/train_model.py — held-out evaluation in-repo |
| Five years of output | github.com/ghost0development — the 2021 archive, never deleted |
How the company handles security work.
Vulnerability disclosure
Coordinated disclosure with a 48-hour acknowledgment SLA. Severity classification published.
security.txt
Machine-readable contact at /.well-known/security.txt, per RFC 9116.
Engineering practice
SBOM (SPDX), build provenance, continuous fuzzing on the eBPF pipeline, CodeQL and scorecard on every repository.
Services
Manual penetration testing (OWASP WSTG, PTES), Linux hardening, eBPF detection deployments, Amazon SP-API audit-readiness work.