Olos Labs

An independent technology lab engineering autonomous systems, security tooling, and digital infrastructure.

Four divisions. Twelve invariants.

Products & Platforms

High-density SaaS, single-origin web apps, and mobile apps on clean architecture.

Go (Fiber), NestJS and Prisma, React and Vite, Flutter, shared Zod schemas

  • Zero CORS ingress: every API route runs through one same-origin /api proxy, and refresh tokens sit in HttpOnly, SameSite=Strict cookies.
  • 0% contract drift: frontend and backend import the same Zod schemas from one contracts package.
  • Inward-only clean architecture: the domain layer has no framework dependencies.

Offensive Security & Tooling

High-speed scanners, recon parsers, and zero-false-positive frameworks.

Static Go (CGO off), token-bucket limiter, Docker mock lab

  • Fail-closed scope guard: a target outside the rules of engagement is cancelled in under 1 ms.
  • Parser self-defense: a 10 MB body limit against zip bombs, XXE protection, and ANSI escape stripping.
  • Proof before release: a binary ships only after scoring 100% true positives and 0% false positives in the Docker lab.

Autonomous Systems & Automation

24/7 pipelines, SQLite WAL state machines, and crash-safe task workers.

Node.js LTS, SQLite in WAL mode, Patchright, exponential backoff with jitter

  • Crash-safe persistence: atomic task transactions survive kill -9 with no data lost.
  • Atomic task claiming: workers compete for the queue with no race conditions and no double runs.
  • Zero phantom tasks: on restart, interrupted work is detected and reconciled.

Web3 & Distributed Infrastructure

EVM invariant fuzzing, solvency invariants, and upgradeable vaults.

Solidity, Foundry invariant fuzzing, ERC-4626, UUPS proxies, Slither

  • Solvency invariant: vault assets must always be at least its obligations, checked across 100,000 fuzz iterations.
  • Checks-effects-interactions: state updates come before external calls, guarded by nonReentrant.
  • Simulate before send: no broadcast without a local eth_call and an Anvil mainnet-fork dry run.

What every release has to be.

Deterministic
Code runs on mathematical law and empirical proof, not on luck or guesses.
Sovereign
We own every layer, from domain logic and data architecture to the server, with no fragile reliance on a third-party platform.
Resilient
Systems are built to survive sudden failure: crash-safe, zero data loss, fail-closed boundaries.
AI-assisted. Human-verified.
AI tools are used, but every line is read, tested, and proven by a person before it ships.

Nothing merges to main until it passes four gates.

  1. Implementation

    Build each module in isolation, following the written plan in order. No skipping phases.

  2. Testing

    Run it for real in a terminal or browser: Playwright, the Docker mock lab, Foundry fuzzing. Exit code 0, or it does not pass.

  3. Senior audit

    Read every line sceptically and look for the smallest complete fix. Keep RSS under 150 MB and remove N+1 queries.

  4. Security review

    Tighten access, block IDOR on session tokens, and audit scope permissions.

One failing test case cancels the release and sends the work back to stage one.

Solo, backwards.

The first name was Solo Labs. From the start, the products, the automation bots, the vulnerability scanners and the smart-contract work were all built by one person, working alone.

sololabs.com was already owned by someone else, so Solo became Olos: the same four letters, reversed. Olos also sits close to the Greek holos, meaning whole, complete, undivided.

A capital S turned on its side forms the outer frame. A lowercase l stands in the middle and joins its two curves into a bridge. An O sits in each loop, and the word LABS underneath finishes the shape.

To most people it reads as an infinity loop or a pair of precision lenses. To the founder it is a minimal sketch of his own face: glasses, narrowed eyes, focused on code and terminal logs late at night.

Many names. One standard.

Olos Labs is the parent, not the brand on the box. Products ship under their own names and domains, each with its own identity, while the lab holds the architecture, the security baseline, and the quality gates behind all of them.

Every product carries the same notice: A Product by Olos Labs, Invariant-Verified Architecture.

[email protected]

Report a vulnerability

Email: [email protected]

Please include:

  • The repository and the version or commit affected
  • A description of the issue and its impact
  • Steps to reproduce, or a proof of concept
  • A suggested fix, if you have one

Do not open a public issue for a security report, and allow a reasonable time for a fix before you disclose.