Rémi Pelloux

I take a product from the first architecture sketch to production, and I keep running it afterwards.

• Platform architecture

  Web, iOS, Android and partner integrations on one core at OpenPro. PostgreSQL, Redis, AWS, CI/CD, EU hosting under GDPR.

• Applied AI

  Matching, retrieval and assistants in production. Agents with approved tools, MCP servers, and models you host yourself.

• Security engineering

  Audits and attack simulation for defence and industry clients. One CVE in Symfony, firmware and kernel research in public.

• Systems and native

  A container runtime in Rust, Tauri desktop apps, Android ARM64 runtimes, C extensions with a tested Python twin.

1. 01

   OpenVision

   An AI coding workspace where you choose the models. It puts an explorer, an editor, terminals, Git worktrees, agents and Tab autocomplete in one desktop app, pointed at any OpenAI-compatible API or a server on 127.0.0.1. You do not need an account to use it.

   2026, development preview

   Portable Windows x64 build

   Electron, TypeScript, MCP

2. 02

   OpenPlod

   A vault on your own disk for Plaud Note Pro recordings. It imports audio over Bluetooth, keeps the original files and turns them into transcripts, Markdown documents and chats that cite their sources. It ships with a REST API and a read-only MCP server.

   2026, MIT

   39 stars on GitHub

   Tauri, Rust, TypeScript

3. 03

   Modelly

   A framework for agent-based modeling in Python. Scenarios are typed and every run is seeded, so a shared config returns the same numbers. Agents are numpy-backed, on grids, networks and continuous space, with pandas data collection.

   2026, Apache-2.0

   Docs published on GitHub Pages

   Python, numpy, pandas, C

4. 04

   HackoogleMini

   I am reverse engineering the Google Home Mini to replace Google Assistant with a local LLM and an MCP voice bot. The repository covers YAFFS2 kernel exploit research, the BLE setup protocol and firmware acquisition.

   2026, security research

   21 stars on GitHub

   Python

5. 05

   Containust

   A container runtime in Rust with no background daemon. Each ctst command talks to the backend directly. Stacks are described in a small declarative language, images are pulled by pinned digest, and an offline flag blocks the network for air-gapped machines.

   2026, source-available

   Linux namespaces, cgroups v2, OCI

   Rust

6. 06

   unslop

   Rules for interfaces and copy that do not look machine-made, with scripts that check them: no shadows, no gradients, no emoji, 350 banned words. The colours, type and copy of this site follow them.

   2026

   Skill, linter and scanner

   Python, Markdown

7. 07

   SmarttyTest

   SmarttyTest runs only the tests a change can affect, across Jest, Vitest, node:test, Playwright, Cypress and Angular. Every skipped test comes with a reason.

   2026, Apache-2.0

   Python and PHP in preview

   TypeScript

More public work

Project	What it is	Stack
OpenNative	Windows games on Android handhelds. A fork of GameNative, validated on AYN Thor. 14 stars.	Kotlin, C++
agent-mangaka-forge	Manga page generation skills with persistent character memory. 19 stars.	Python
android-hid-kb	A rooted Android phone as a USB keyboard, using configfs and shell builtins only. 10 stars.	Shell, Python
kill-my-idea	A Claude Code plugin that researches a business idea and scores it out of 100.	HTML, Markdown
gitverse	A Git course with a simulated terminal and a live commit graph.	TypeScript
DrosoSim Next	Real-time decision simulator against the fruit fly Drosophila suzukii.	TypeScript
LumaSync	Local Philips Hue ambilight driven by screen capture.	Rust, Tauri
OpenSw	Nintendo Switch emulator for Android ARM64 with Vulkan rendering and per-game profiles. 4 stars.	C++, Vulkan
BurpHunterTK	Burp Suite extension that uses LLMs to flag high and critical vulnerabilities. 5 stars.	Python
OpenAgents	Self-hosted agent platform for several model providers, a fork of Hermes Agent.	Python, MCP
delonghi-coffee-api	Local REST API for De'Longhi coffee machines, from the reverse-engineered ECAM protocol.	Python, Docker
openpro-connector-sdk	SDK that syncs ATS jobs into OpenPro from PHP or any language.	PHP
openwhistle-sdks	OpenWhistle API clients in five languages.	JS, Python, PHP, Rust, Go
templateCardGame	Template for server-authoritative multiplayer card games, shipped with Crazy Eights.	TypeScript
wildlands-ubisoft-connect-launch-fix	One-click launch fix and technical report for Ghost Recon Wildlands on Windows 11.	PowerShell

Every other public repository is in the archive.

I build products during the day and take other people's apart in the evening. What I find goes to the maintainers first.

Disclosures, research and contributions

Reference	Project	What happened
CVE-2026-45753	Symfony HtmlSanitizer	The URL sanitizer skipped the action, formaction, poster and cite attributes, so a javascript: URI survived sanitization and allowed XSS. I reported it and the Symfony team fixed it. Advisory published on 28 May 2026.
2026, in triage	Tailscale	I sent reports to the Tailscale security team. One finding was new to them and is being fixed, with credit in the fix. Another matched an issue they had already fixed. Details stay private until the fix ships.
CVE-2026-109618	PHP	My independent source-level analysis of the session.upload_progress use-after-free (also CVE-2026-109619, CVSS 9.2, fixed on 21 October 2026), with a heap layout study, a reproduction lab and an exposure scanner. I did not find this one, I studied it.
GalaxyCrash	Samsung Galaxy	Temporary root for research on your own device, a stability fork of DirtyFrag built on CVE-2026-43284. A reboot undoes it. 5 stars.
PR 1282	awesome-ai-plugins	Merged pull request adding kill-my-idea to the list, 11 November 2026.

OpenPro is a French professional network for people, jobs and companies, with video CVs, AI matching, messaging and an assistant named Mia, on web, iOS and Android.

The code is private. I have been CTO since February 2023, and this is the engineering I answer for.

• A PHP and Symfony core, TypeScript and React on the web, apps for iOS and Android, shipped on one roadmap.
• Matching, retrieval and the Mia assistant, written in Python and connected through MCP.
• ATS connectors through a public SDK over HTTP and MCP.
• PostgreSQL and Redis on AWS, in Docker, released through CI/CD, hosted in the EU under GDPR.

Other products I built and run: LeadsIt, an automated B2B lead search platform, OpenWhistle, audio turned into structured data, and deal-club.fun, a French real-estate card game that plays offline.

Work history

Years	Role	Work
2023 to now	CTO and co-founder, OpenPro	Product design, architecture and full-stack build of an AI recruitment platform. Nice, remote.
2024 to 2025	Security and full-stack lead, SaaS Office	A vulnerability management tool in Python and a framework that simulates attacks on network, DNS and cloud. Valbonne.
2023 to 2024	Lead developer R&D, MOABI	Research on software energy dependence, a C backend migration, Symfony 5.3 to 6.4, security audits. Clients: Dassault Aviation, DGA, Thales, Decathlon. On site in Rennes and in Hengelo, in the Netherlands.
2020 to 2023	Lead full-stack developer, Therascience	Internal tools for logistics and CRM, APIs, monitoring and e-commerce interfaces. Monaco.
2019 to 2020	CTO, Votre-marketing.fr and AdWatch	Internal CRMs, business applications and paid campaigns. Sophia Antipolis.
2016 to 2019	Web development trainer	Courses in HTML, CSS, JavaScript, PHP, Symfony, Node.js and Python for Pôle Emploi, Orsys and SoftTeam, in Lille, Paris, Lyon, Clermont-Ferrand, Bordeaux, Poitiers, Aix-en-Provence and Avignon.

Master's degree in computer science, SophiaTech, Sophia Antipolis. Bachelor's degree, Université de Nice. French native, English professional, Italian intermediate.

The full record is on the CV, in French and English. The unofficial one is in the wiki.

Languages, by number of repositories that contain them

1. TypeScript95
2. JavaScript83
3. Shell81
4. Python68
5. Rust31
6. SQL17
7. PHP13
8. C8
9. Swift8
10. PowerShell6
11. Kotlin5
12. Go4
13. C++2
14. Dart2
15. Java2
16. Terraform2

161 repositories, public and private, forks excluded. GitHub, 11 November 2026.

Frameworks and tools

Web

React, Next.js, Vue, Astro, Symfony, Twig, Node.js, SCSS

Desktop and mobile

Tauri, Electron, Flutter, native Swift and Kotlin

AI

LLM agents, MCP servers, retrieval, Ollama, Mistral and Voxtral, OpenAI-compatible APIs, Claude Code plugins

Data

PostgreSQL, PL/pgSQL, Redis, MySQL, SQLite full-text search, numpy, pandas

Infrastructure

AWS, Docker, Terraform, GitHub Actions, Linux namespaces and cgroups, QEMU

Security

Burp Suite, IDA, Ghidra, nuclei, adb, firmware and protocol reverse engineering, attack simulation

Testing

Cypress, Playwright, pytest, Jest, Vitest, ruff

Graphics and runtimes

Vulkan, GLSL, Wine, DXVK, Box64

Growth

SEO, Google Ads, Facebook Ads, Stripe billing

Born in Antibes, studied in Sophia Antipolis. Then three years on the road as a trainer, in Lille, Paris, Lyon, Clermont-Ferrand, Bordeaux, Poitiers, Aix-en-Provence and Avignon, before coming back to the coast: Monaco, Valbonne, Nice, with missions in Rennes and in Hengelo, in the Netherlands, for MOABI.

France and the Netherlands: where I trained and where MOABI sent me

The coast, closer

1. Antibes, born here
2. Sophia Antipolis, 2015 to 2020
3. Monaco, 2020 to 2023
4. Valbonne, 2023 to 2025
5. Nice, now