Web Design & Development
Fast, privacy-first websites and web apps. Static-first, no trackers, accessible, instant to load, exactly like this page: zero JavaScript, zero third-party requests.
root@securityops:~$ ./portfolio --boot
Systems · Security · Open Source
Cristian Cezar Moisés
Security Ops®/Post-Quantum Crypto /Self-Hosted Infra
IT analyst by profession, open-source builder by obsession. I write post-quantum backup, transport and audit tools, hardened GNU Guix systems, and privacy-first self-hosted services in C11, Rust, Python and Scheme, for a safer and more transparent internet.
In Code We Trust.
online · Brazil
Engineering, not marketing.
I'm an IT Support Analyst in Caxias do Sul, Brazil, and a self-taught systems and security builder. Everything under the Security Ops® banner is written in my own time, released as free software, and run on infrastructure I administer myself, on clearnet and on Tor. The goal is simple: a safer, more transparent internet, protecting users through FOSS.
The work concentrates where security actually has to hold. Post-quantum cryptography (ML-KEM, ML-DSA) applied to backup, transport and audit logging. Hardened, reproducible GNU Guix systems, down to a custom kernel. Self-hosted privacy services. Constant-time primitives are written in Jasmin and checked by its type system; conformance is measured against the official NIST ACVP vectors, not asserted. Every performance number on this page is reproducible from the linked source, or it is labelled an estimate.
I ship in C11, Rust, Python, Bash, Scheme and Kotlin. I hold a technical degree in Information Security and am pursuing a postgraduate degree in Software Engineering. Commercial work runs through my registered Brazilian company (CNPJ in the footer) with the same standard: complete code, real tests, and NIST/RFC vectors wherever cryptography is involved.
Security Ops® is a trademark registered with INPI Brasil, and I treat that in both directions. When a prior INPI registration turned up on the name "Zupt" for unrelated software, I renamed my own backup tool to VaptVupt rather than argue about it. The archive format did not change; only the name did.
56repos on git.securityops.co
80/80NIST ACVP ML-KEM vectors
6CPU architectures VaptVupt builds on
0JavaScript on this site
Repository count from my Forgejo instance, July 2026. The ACVP and architecture figures come from the READMEs of the projects linked below, where the commands to re-run them are documented. Nothing here is a marketing number.
2024 to present
Founder & Maintainer, Security Ops®
Independent free-software label: post-quantum backup, transport and audit tools, a hardened Guix distribution, a personal Guix channel, plus self-hosted Forgejo, search, wiki and Tor services.
Current
IT Support Analyst, industrial group, Brazil
Enterprise IT operations by day. All Security Ops work happens outside working hours, on my own hardware and infrastructure.
Education
Information Security (technical degree) · Software Engineering (postgraduate, in progress)
Plus vendor-issued, Credly-verified course badges, listed on my GitHub profile.
What I build for clients.
Websites, software and security work, delivered complete, documented and buildable, through my registered Brazilian company (CNPJ in the footer).
Software Development
Systems software in C11, Rust and Python: CLIs, daemons, libraries and protocol implementations. Zero-warning builds, sanitizer-clean, tested, packaged for real installs.
Post-Quantum Migration
Cryptographic inventory, crypto-agility assessment and migration to ML-KEM / ML-DSA, with a tamper-evident audit trail if you are regulated. Find what breaks under a quantum adversary before it does.
Secure Self-Hosted Infrastructure
Hardened deployments with defense-in-depth: Docker, GNU Guix, nftables, WireGuard, Tor and clearnet, reverse proxies and monitoring. Threat-modelled in plain language.
Linux & GNU Guix Engineering
Reproducible system configuration, kernel and GPU tuning, custom channels and packaging. The same discipline behind my public guix-config (16★ on Codeberg) and Security Ops OS.
Commercial Licensing
Several projects ship AGPL-3.0 with a commercial license option for enterprise use. Talk to me about dual-licensing, integration and support.
Post-quantum, by default.
Canonical source lives on my self-hosted Forgejo at git.securityops.co, mirrored to Codeberg and GitHub. Versions below are the shipped ones.
// regulated
Cofre Soberano PQ
A post-quantum cryptographic boundary for Brazilian regulated industries: banks, insurers, healthcare, government. QAudit writes an offline-verifiable, append-only, Merkle-chained log signed with ML-DSA-87, so any holder of the public key can verify the whole chain with no network and no clock. QGateway proxies plain TCP into the CSPQ transport.
// backupVaptVupt
Backup compression with hardware-adaptive codec selection, AES-256 authenticated encryption, post-quantum key encapsulation and full-disk backup. Pure C11, zero runtime dependencies, roughly 13,000 lines. Formerly Zupt.
// compressionVaptVupt Codec
The LZ + tANS codec underneath the backup tool, in C11 with zero runtime dependencies. Open wire format with byte-exact reference decoders in Python and JavaScript; every release is gated on byte-identical output and sanitizer-clean handling of corrupt input.
// sdklibvuptsdk
Post-quantum hybrid cryptography for production applications: ML-KEM-768 with X25519, XChaCha20-Poly1305 by default, BLAKE2b key commitment, mlock'd private keys. The critical primitives are written in Jasmin and proven constant-time by its type system. Bindings for C, C++, Python, Node.js, Go and Rust.
// tunnelEvelin
Post-quantum secure tunnel with an SSH-shaped toolchain, named after my late mother. Production-validated against an internet-exposed host since v2.0, with a published, honest comparison against OpenSSH. AGPL-3.0 with a commercial license option.
// protocolBTP
Berkeley Transport Protocol: a clean-break post-quantum successor to HTTP+TLS, with no CA trust model and witness-anchored identity. The wire format is stable and conformance-tested, and the whitepaper is on Zenodo with a DOI.
// databasemirim
A tiny embedded SQL database, encrypted at rest by default. Roughly 3,800 lines
of safe Rust under #![forbid(unsafe_code)], XChaCha20-Poly1305 vaults keyed by Argon2id,
ML-KEM-768 sealed exports, and a durable write-ahead log enforced by a 60-iteration SIGKILL
harness: no acknowledged commit may go missing after a crash. Tupi-Guarani for "small".
Security Ops OS
A hardened, private, reproducible GNU Guix System shipped as a boot-anywhere live ISO: custom Linux 7.1.3-SecurityOps kernel, sway on Wayland, a guided disk installer, and a curated offensive and forensics toolkit. The whole OS is channels.scm plus config.scm, so anyone can guix time-machine it back bit-for-bit. No secrets baked in.
// commsKeyWave
End-to-end encrypted peer-to-peer chat and video. No accounts, no persistence; the server only relays the handshake. Every pair derives its own keys from ECDH P-256 and ML-KEM-1024 through a transcript-bound HKDF, and no classical-only fallback exists, so a downgrade cannot be negotiated.
Tools, experiments, write-ups.
Smaller utilities and posts: privacy tooling, Guix, Tor, containers, recording, and the occasional web OS. Full archive on cristiancezarmoises.com.
// browser
Security Ops Extension
Privacy-first browser hardening for Chrome, Edge and Firefox (Manifest V3): blocklists, YouTube ad stripping, tracking-parameter removal, HTTPS enforcement, dark theme, one-click Tor and a panic button. No telemetry. GPL-3.0-or-later.
// privacyTorando Control
Routes one Linux user's egress through Tor as a transparent proxy, with a killswitch so nothing leaks if Tor drops. Unprivileged GTK4 front end over a small root daemon; Python standard library only.
// guixsecurityops channel
A personal GNU Guix channel: the newest upstream release of every application this workstation lives in, with real source hashes and definitions that inherit from upstream so they stay small and auditable.
// webVaptVupt Web
Post-quantum backup in your browser. One docker compose up, no accounts, no cloud. Your keys, your data, your server.
// androidVaptVupt Android
Post-quantum encrypted file compression on Android. Fully offline, F-Droid ready.
// librarylibvaptvupt
The codec as a drop-in library for C, C++, Python, Node.js, Java, Guile and Haskell: 76 tests across the seven bindings.
// containersEsquema
Rootless, daemonless container runtime written natively in Guile. User namespaces, pivot_root, every capability dropped, a seccomp-BPF allowlist and cgroups v2. Declarative Scheme, no YAML.
// recordingTurbo Recorder
Screen and audio recorder for Linux, macOS, Windows, BSD and Guix. Probes your machine, picks the best hardware encoder (NVENC / QSV / VAAPI / AMF / VideoToolbox), then records real-time at correct speed. Wayland and X11. Dark GUI plus CLI. GPL-3.0.
// web osSecurityOS
An amnesic web workspace. Every request leaves over Tor (SOCKS5h, so .onion resolves and clear-net hostnames never leak) through an SSRF-guarded proxy that fails closed, and the VaptVupt engine runs in WebAssembly for in-browser encryption.
// videoSecTube
A self-hosted YouTube front end. React SPA behind a hardened OpenResty proxy that rotates API keys server-side, so they never reach the browser, and caches responses to stretch quota. No login.
// guixguix-config
The declarative Scheme behind two machines: an Intel/NVIDIA laptop daily driver and an archived AMD desktop, with the free-software trade-off between them written down honestly. 16★ on Codeberg.
// guixguix-vault
Guix-native, reproducible backup and disaster-recovery system.
// guixguix-install
An easy GNU Guix installer in shell: run it from any live ISO and it fixes and writes your /mnt/etc/config.scm for you.
// privacyTorando
The original system-wide Tor VPN in shell. 31★ on GitHub.
// emacswhatsapp.el
A full WhatsApp client for GNU Emacs over a Baileys bridge: 70 interactive commands, 80 keybindings.
// websecuritynews
Fast, dark-theme Hacker News front end, without JavaScript.
// defensegetout
Scripts to block malicious attackers at the edge.
// educationTor Course
The first Brazilian hacking and infosec course hosted on the Tor network.
// opsUptime
Public status monitoring for every Security Ops service.
Published work.
Berkeley Transport Protocol (BTP): A Post-Quantum Application Substrate with Witness-Anchored Identity
The design rationale behind BTP: why a clean break from HTTP+TLS, and how identity is anchored by cross-witness attestation instead of certificate authorities.
DOI 10.5281/zenodo.20278231The Omnidimensional Quantum-Cosmological Theory (OQCT)
An independent theoretical framework exploring quantum cosmology across dimensions. Source in TeX at git.securityops.co/cristiancmoises/oqct.
SSH for Hacking
SSH usage with a high level of security and obfuscation: tunnels, hardening, tradecraft.
ResearchGate · ORCID 0000-0001-9533-4916
Full research record, preprints and identifiers.
Tools of the trade.
Languages
C11RustPython
BashScheme / GuileKotlin
Emacs Lisp
Cryptography
ML-KEM · FIPS 203ML-DSA · FIPS 204
XChaCha20-Poly1305AES-256-GCMAES-256-SIV
BLAKE3SHA-3Argon2id
HKDFX25519/Ed25519
Verification
JasminFrama-C / ACSL
NIST ACVP vectorsConstant-time
ASan / UBSanReproducible builds
Systems
LinuxGNU GuixGentoo
FreeBSDOpenBSDDocker
NginxnftablesWireGuard
Privacy & Ops
TorForgejo (self-hosted)
Hardening / KSPPThreat modeling
MonitoringPKCS#11 / HSM
Let's build something secure.
A website, a piece of software, a hardened server, or a post-quantum migration. Send a message. I read every one.
sac@securityops.co