Brantschen Labs
EN/DE

Systems & Security consulting · Bern & Valais

We build it.
We secure it.
We keep it running.

Brantschen Labs designs, operates and defends the systems a business actually depends on — Linux and Windows estates, private networks, web platforms, and the blockchain protocols that move real value.

If a finding is not reproducible, it is not a finding. If a system is not monitored, it is not running.

Book an infrastructure call Request a security review

MONITORED

01Systems practice

Services

Build it. Secure it. Run it.

Three practices, one engineer. Systems and Security consulting — from a single adversarial review to full responsibility for the systems themselves.

01

Build

Systems that did not exist yesterday.

  • Infrastructure & datacenter

    Server rooms, racking and virtualisation platforms on Proxmox, VMware or Hyper‑V. New environments, migrations and consolidations — Linux and Windows Server, provisioned as code.

  • Web & applications

    Websites and web platforms end to end — design, build, and hosting on infrastructure we run ourselves.

  • Web3 & smart contracts

    Solana programs and EVM contracts, SPL and Token‑2022 launches, NFT and Metaplex integrations, wallet‑connected front ends.

  • Automation & AI engineering

    Internal tooling, agent pipelines and scheduled analysis that encode an expert workflow.

02

Secure

Because someone else will try.

  • Protocol research & audit

    Smart‑contract and validator‑client review across Solana, EVM, Move, Substrate and Cosmos — delivered as a runnable exploit, not a checklist.

  • Infrastructure security review

    Hardening, configuration and exposure audits, access and secrets handling for the estate you already run.

  • Application security review

    Web applications, APIs and the identity in front of them — the same standard of proof as the protocol work, not a scanner report.

  • IT and Security consulting

    Threat modelling, disclosure processes, incident response, and IT advisory that makes an audit report actionable on Monday morning.

03

Run

The half that decides whether it survives.

  • Linux & Windows operations

    The hosts the rest sits on. Linux and Windows Server, directory and patch cadence — operated as if they were ours.

  • Networks & connectivity

    Segmentation, firewalling and private mesh access that does not depend on a vendor portal.

  • Operations & resilience

    Monitoring, alerting, patching, log retention and backup — with restores that are actually rehearsed.

  • Validator & node operations

    Solana and EVM nodes, RPC endpoints and staking infrastructure, run by the person who audits this software for a living.

  1. 01

    Scope

    What is in, what is out, what proof looks like.

  2. 02

    Work

    Build, secure or operate — you talk to the person doing it.

  3. 03

    Proof

    A running exploit, a restore test, or a system that stays up.

  4. 04

    Handover

    Notes, diagrams, and the access to run it without us.

Infrastructure

The stack we actually run

Small‑team infrastructure, built to be operated and understood by the people who own it — not by a support contract.

Network estate: internet, firewall and VPN, switch and VLANs, virtualisation, Linux and Windows VMs, storage, client infrastructure
  1. INTERNET
  2. FIREWALL / VPN
  3. SWITCH / VLANS
  4. VIRTUALISATION
  5. LINUX / WINDOWS VMs
  6. STORAGE / BACKUP
  7. CLIENT INFRA
A typical small‑team estate: virtualised, segmented, monitored, recoverable.
Platform

Linux · Windows Server · Proxmox VE · VMware vSphere · Hyper‑V · Citrix · Docker

Network

Cisco · Fortinet · VLAN · SD‑WAN · MPLS · 802.1X · WireGuard · nginx

Security

Sophos · OPNsense · PKI · SIEM · Entra ID · SSO · Hardening

Cloud

Microsoft 365 · Azure IaaS / PaaS · Hybrid identity

Storage

SAN / NAS · NetApp · Veeam · Backup & DR

Code

PowerShell · Python · Terraform · Rust · Go · TypeScript · React

Web3

Solana / SVM · Anchor · EVM / Solidity · Foundry · Metaplex · Sui & Move · Substrate

Compute & virtualisation

Bare‑metal and virtualised Linux and Windows Server hosts on Proxmox, VMware or Hyper‑V. Capacity planning, hardening, patch discipline.

Networking

VLAN segmentation, firewalls, private mesh (WireGuard/Tailscale), reverse proxies and TLS termination.

Storage & backup

Redundant storage, snapshotting, offsite copies and restores that are actually rehearsed.

Identity & access

SSH key and certificate management, least‑privilege accounts, secrets handling, audited administrative access.

Containers & services

Docker and Compose, service isolation, health checks, zero‑downtime restarts, private registries.

Databases

PostgreSQL and Redis: tuning, replication, migrations, point‑in‑time recovery.

Observability

Metrics, structured logs, uptime and certificate monitoring, alert routing that respects working hours.

Automation & CI

Infrastructure as code, deployment pipelines, scheduled jobs with real failure reporting.

02Security practice

Security overview

Reported, fixed, shipped

Selected findings, each reported through the project’s own security channel and resolved before publication.

Adversarial research runs as its own practice, with its own method and its own standard of proof. Findings go through each project’s security channel and are resolved before publication — the record below is what came out the other side.

PERIMETERPROTOCOLRUNTIME
ProgramFindingStatus
MetaplexMissing signer check on the execution delegate allowed an attacker to forge a delegate for any agent asset and drain the asset signer.Resolved
Anza / AgaveTwo unbounded, root‑retained gossip‑vote maps drivable to kernel OOM by a single minimum‑stake vote account — remote memory exhaustion (GHSA‑pr3x).Fix shipped — all clusters
SPL Token‑2022State corruption permanently locking deposited SOL (GHSA‑4h56).Resolved
Nervos CKBCritical deserialization flaw in the DAO withdrawal path.Resolved
LedgerStellar application finding (BBP‑69).Resolved
ConfluxCross‑SDK differential: the Go SDK signed EIP‑1559 transactions with the priority fee set equal to the max fee.Resolved

Further disclosures are under coordinated embargo or in adjudication and are listed once resolved.

Request a security review

The person

Who you are working with

I am Tobias Brantschen. Brantschen Labs is my practice — one engineer, no account layer.

I work on-site with clients in Bern and Valais. The practice is registered in St. Niklaus.

I have built and operated production infrastructure since 2012, when I finished my apprenticeship as Informatiker EFZ. Over thirteen years of Linux and Windows estates, networks, virtualisation, storage and backup — the unglamorous half, where systems either survive contact with reality or do not.

The research grew out of that. Reading other people’s protocol code the way I read a firewall ruleset: assuming it is wrong until the failure mode is reproducible. Every finding listed above went through the project’s own security channel and was fixed before it appeared here.

I hold the ISC² Certified in Cybersecurity, alongside vendor certifications for the platforms I run.

The two halves are not separate services. Auditing protocols makes me a better operator; operating infrastructure makes me a better auditor. Most people offering one have never done the other.

Illustrated portrait of Tobias Brantschen

Contact

Start a conversation

On-site in Bern and Valais. Available for reviews, retainers, and the systems themselves.

Enquiries

info@brlabs.ch

Security contact

tobias.brantschen@brlabs.ch
Named point of contact for suspected compromise, credential revocation and abuse enquiries.

Principal

Tobias Brantschen
Founder & Security Researcher
tobias.brantschen@brlabs.ch

On site

Bern and Valais.
Remote across Switzerland.

Book an infrastructure call

46.1783° N07.8058° E