I build software in Amsterdam. I think it should be open.
I have a political science background and I work as a software engineer. The engineer wants to ship the thing and watch what it does. The political scientist asks who pays, who decides, and who never got asked. Everything below is what those two halves agreed on.
Hacking is curiosity, not crime. The word got hijacked. A hacker is someone who opens the box to see how it works. I wrote about it in 2016 and I stand by every line.
Software you can't read is a promise you can't verify. Transparency and trust are not the same thing. Trust asks you to believe me. Transparency lets you check. That is why Quodeq is MIT licensed, runs on your machine, and ships with no account, no telemetry, and no server of mine in the path. You don't have to trust me. You can read it.
Code is political. Whoever writes the software decides how it behaves. States depend on code they didn't write and can't inspect. I made that argument about free software and sovereignty in 2014, and in June 2026 a single export order pulled a frontier model out from under every customer outside the United States, overnight. It aged better than I hoped.
Some people bet everything on your digital freedom. A few of them paid dearly for it. The least we can do is not waste what they won.
Quodeq is an open source AI code auditor. Point it at a repository and an agent reads the code file by file, follows the imports, and tells you what is solid, what is broken, and how to fix it. Findings map to CWE identifiers and roll up into grades across the six ISO 25010 quality dimensions: security, reliability, maintainability, performance, flexibility, usability.
Models are now good enough to find real design flaws and vulnerabilities that review misses. Most of the tools built on that capability sit behind an enterprise contract and a sales call. That gap is the whole reason the project exists.
The build decisions are the argument:
- MIT. Fork it, read it, sell it. No open core, no paid tier holding the useful half.
- Local. Evaluation runs on your machine and results land in
~/.quodeqas JSON you own. - Your model, your call. Ollama if you want it fully offline and free. Claude, Codex, or Gemini if you want it fast.
- No account. Nothing to sign up for, nothing phoning home.
Currently v1.8.1, on PyPI and Homebrew, with a desktop app for macOS.
I build Quodeq with AI, heavily, and I am deliberate about where I let it decide.
Architecture and the irreversible calls stay with me. Inside those boundaries, most of the work can be delegated, and increasingly it is. The reason is not purity, it is debuggability. Let a model make enough unsupervised decisions and you end up with a system that runs, that passes its tests, and that nobody can reason about six months later, including you. You lose control not because of one bad call, but because the codebase stopped being legible.
So the job is boundaries, interfaces, and an architecture clear enough that any decision can be found and undone. Reviewing every generated line by hand is the other failure mode. It does not scale, and it ends with you approving everything because it all looked fine.
Currently in English, on the quodeq blog.
- God Does Not Play Dice. We Built Software That Does. (2026). Our software is probabilistic now. That part is settled. What we build around it is not.
- Europe's Fable: The Off Switch Was Never Ours (2026). Reading the code was never the same as holding the switch.
- Before it gets a number (2026). The weakness is in your code long before a CVE gives it a name.
- Your Dependencies Are Someone Else's Attack Surface (2026). Two years of helpful patches, then a backdoor headed for every Linux machine on the planet.
Earlier, in Spanish, at United Explanations. The voice is more florid than I would write today. The arguments held.
- Eres un hacker y quizá no lo sepas (2016). What hacker actually means.
- 6 informáticos que lo apostaron todo por tu libertad (2015). Six people who paid for your digital rights.
- Soberanía y Software Libre (2014). Why free software matters for a state's independence.
- El éxito tangible del 15M (2012). What the indignados actually changed.
Over a decade of Android, currently at DPG Media. Most of that work is not mine to publish, so this profile is thinner than the years behind it.
The exception worth keeping is Safegees, from Peacehack Barcelona 2015, where it won first prize. A set of tools letting someone travelling in dangerous conditions share information with their own circle and with NGOs they chose, instead of with whoever else was collecting it. Built with Álvaro Abella Bascarán, Guillem Hernandez, and Gerard Martí Tarragó, under GPL v3. Archived now. It was the first time I built the 2014 essay instead of writing it.