systems · security · anonymity · privacy

Leontii
Maksimov

Systems and security engineer. I write low-level C/C++, ship Flutter apps to both stores, and run the infrastructure I depend on myself.

Contact PGP keys Encrypted CV

GitHub ↗

key randomart

8523854119440E8893030D96CA55434DDF0271E4

0xCA55434DDF0271E4all keys →

about

These days I work in a small freelance team: mobile builds, security reviews and penetration tests for clients who come to us through my employer's reputation. Before that, I led the embedded team on a high-performance UAV.

principles

self-host over SaaS
understand it before you call it
privacy is structural.

Rolesystems & security engineer

Nowsecurity consulting · malware research · CJCA

focusoffsec · anonymity · embedded

shipsiOS · Android · firmware

OSFreeBSD 15.0-RELEASE · QubesOS · Tails

LangsC, C++, Python, Java, OCaml, Lean, Dart

Speaksru (native) · en (C1/C2) · de (C1)

citizenRussian / German

PGP0xCA55434DDF0271E4 + PQC v6

contactSimpleX preferred

CVargon2id-locked

experience

Flutter Developer & Security Consultant freelance team Jan 2026 – present

Part of a small freelance team. Clients come through my employer's reputation and network; I cover the mobile and security side.

Building the iOS and Android app for Crubba, an unreleased cooking product: interface, state handling and release builds for both stores.
Security advising and penetration testing for crubba.se, the web platform behind the app, with written findings and fixes handed back to the client.

Embedded Systems Team Lead & Sysadmin Phantum e.V., Munich Nov 2024 – Dec 2025

Led the embedded team that designed and built the integrated control system for a high-performance UAV.
Worked on the design of the microcontroller-based afterburner and water-injection systems.
Ran the team's Linux communication and software-license servers.

Mathematics Tutor Nachhilfe Defoort Oct 2023 – Jan 2024

German Mittelstufe and Oberstufe mathematics, up to Abitur level.

Systems Administration Intern Moscow State University Jun – Aug 2022

Day-to-day administration of a large university network.

education

Informatics · B.Sc. SRH Hochschule Oct 2026 – present

Continuing my informatics studies.

Informatics · B.Sc. programme Technische Universität München Oct 2023 – Mar 2026

39 ECTS across the core of the programme:

Introduction to Informatics Algorithms & Data Structures Computer Architecture Lab Programming Lab Discrete Structures Analysis for Informatics

International Baccalaureate Diploma Berlin Brandenburg International School 2013 – May 2023

Higher Level: Mathematics, Physics, English, German. Standard Level: Chemistry, Economics.

current focus

HTB Certified Junior Cybersecurity Associateexam pending

Hack The Box Academy. Coursework almost complete: blue-team triage, log analysis, network forensics, malware identification, incident response, hands-on labs against live attack chains.

Offensive security & malware internals

Sustained independent study of malware analysis and development, evasion and anti-analysis techniques, kernel-mode persistence, exploitation primitives and modern offensive tradecraft. The canon, not the blogs.

Shipping Crubba

Taking a Flutter app from prototype to store release on iOS and Android, and testing the platform behind it as I go.

Local AI

Self-hosted models: serving through Open WebUI, fine-tuning with Unsloth, and agent-driven workflows on top.

HackaTUM 2024 MIT · Introduction to Machine Learning COMPSCI 224 · Advanced Algorithms Particle physics masterclass · HU Berlin IceCube masterclass · DESY Zeuthen

projects

I2P_Crawler

source ↗

Python · anonymity tooling

Walks the I2P network through a local i2pd proxy on 127.0.0.1:4444, logging every reachable destination and harvesting the .onion and clearweb links it finds. Slow on purpose; clearweb links are recorded but never followed, so the crawler never reveals itself outside the anonymity network.

gemma4-vuln-scanner

source ↗

Python · SAST · LLM-assisted offsec

LLM-powered static analysis for finding bugs, exploitable flaws and crashes in security-critical codebases. Eight-pass pipeline: SAST (Semgrep / cflow / Bandit), tree-sitter function extraction, a NetworkX call graph for risk scoring, multi-lens review on a local model (Ollama, gemma4:31b on an RTX 5090) and a judge pass that filters false positives. SARIF and HTML reports, ~7,400 lines, 43 unit tests, native systemd deploy, no Docker. First targets: the OpenBSD source tree and the I2P Java codebase.

BootWarden

source ↗

system security · anti-Evil-Maid

Minimalist verifier for unencrypted boot partitions in high-risk environments. Validates the bootloader cryptographically before the OS loads to mitigate Evil-Maid attacks, shipped on a separate Void Linux + musl ISO, for setups where moving /boot to a dedicated USB isn't an option, e.g. keeping Qubes' sys-usb.

PasswordSplitter

source ↗

C++ · secret sharing

Splits a password into n shares; only all n together recover it. Useful for spreading a high-value secret across places or people. An early project, kept for the idea rather than the implementation.

infrastructure

Built and run alone, on hardware I own. Self-hosting on principle: if I depend on it, I want to understand it.

homelab

Pi-holeDNS-level ad and tracker filtering for everything on the network.

SearXNGPrivate metasearch instance. Also the search backend for my agents.

local AI stackDeepSeek harness with plugins I write, inference through Strata and Ninfer, Open WebUI on top and fine-tuning with Unsloth.

agentsAutonomous agents for reconnaissance in penetration-testing and reverse-engineering work, backed by the SearXNG instance.

isolation: one FreeBSD jail per service: no shared filesystem, no shared process namespace. Compromise of one doesn't imply compromise of another.

anonymity networks contributor

Privacy is structural, not a feature you opt into. These networks only work if enough people run the plumbing. I'm one of them, on all three.

Torrelay operator

Bandwidth and uptime for the network that keeps journalists, activists and the merely curious off the record.

I2Pfloodfill operator

Floodfills carry the netDb, and the network always needs more of them than it gets. Routing for others, not just consuming.

Monerofull node · community

Full monerod node, opportunistic mining, and help on the periphery: wiki patches, wallet help for newcomers, the odd translation. RingCT + Bulletproofs + Dandelion++ is the right architecture for cash.

stack

languages

C · C++ systems
Python tooling
Dart · Flutter mobile
Java
OCaml · Lean fp · proofs

systems

FreeBSD · Linux admin
embedded firmware · MCUs
networking · DNS
PostgreSQL
reverse proxies · self-hosting

hosting

nginx · caddy http
postfix + dovecot mail
unbound + bind9 dns
wireguard mesh
nftables · pf firewall
prometheus + grafana metrics

offsec

penetration testing
exploit development
malware analysis & development
reverse engineering
evasion · anti-analysis

defense

secure coding
network forensics
incident response
applied cryptography
opsec · anonymity

ai

local model deployment
DeepSeek harness plugin author
Strata · Ninfer inference
Open WebUI
Unsloth fine-tuning
agent workflows

unices

FreeBSD infra
OpenBSD edge
QubesOS daily driver
Tails amnesic
Linux general

init

systemd linux
runit void · artix
OpenRC alpine · gentoo
rc.d freebsd · openbsd

userland

zsh shell
tmux mux
neovim editor
sway · dwm wm

cryptography

AES-128/256AES-GCMChaCha20Poly1305X25519Ed25519HMAC-SHA256HKDFArgon2idSHA-256BLAKE2bconstant-time compareRNG hygiene

Written from scratch in C to understand them, not to ship them. In production: libsodium when I get to choose, OpenSSL when I don't. Mail: gpg. Files at rest: age. KDF: argon2id, and the CV gate below is one.

contact

SimpleX preferred. Writing by mail instead? Encrypt to one of the keys below.

simplex · preferred

https://smp12.simplex.im/a#z-Jgjn6ewhmt0vidxJElMjH9CrAeR9CKkphaIcYLSHo

open ↗

mailto ↗

signal

Throne.66

session

0592a7881739359d428e89e7a97c2835bcd80763a24ea7d4bae7af67dc7b78687a

pgp keys

Maksimov<[email protected]>classic

fingerprint

8523854119440E8893030D96CA55434DDF0271E4

key id0xCA55434DDF0271E4 algorithmbrainpoolP512r1 · ECDSA / ECDH formatOpenPGP v4 created2026-10-18 Works with any OpenPGP client: GnuPG, Thunderbird, Sequoia, OpenKeychain.

gpg --armor --export 0xCA55434DDF0271E4

Maksimov_PQE<[email protected]>post-quantum

fingerprint

7F4D927B2B4C497C42777A0F85BD17CFCDB58805AB3755440B998E2DB2F42AA2

key id0x7F4D927B2B4C497C algorithmML-DSA-87+Ed448 · ML-KEM-1024+X448 formatOpenPGP v6 · RFC 9580 created2026-10-18 Hybrid post-quantum key. Needs a client that speaks v6 keys and the OpenPGP PQC algorithms; GnuPG 2.4 can't import it, so use the classic key there.

sq cert export --cert 7F4D927B…2AA2

cv

Full CV is sealed with argon2id + AES-256-GCM. If we've spoken, ask me for the passphrase.

./decrypt-cv --kdf argon2id --cipher aes-256-gcm cv.pdf.enc

download cv.pdf sha256 …

LeontiiMaksimov

about

experience

education

current focus

projects

I2P_Crawler

gemma4-vuln-scanner

BootWarden

PasswordSplitter

infrastructure

homelab

anonymity networks contributor

stack

languages

systems

hosting

offsec

defense

ai

unices

init

userland

cryptography

contact

pgp keys

cv

Leontii
Maksimov