A lab building software for mathematics and interpretable machine learning.

KodamaSEC was founded on a simple premise: advanced algorithms and machine learning systems should be understandable, not just performant. We design methods for large-scale mathematical and numerical problems, and build machine learning models whose behavior can be examined and explained rather than treated as a black box. Concretely, results are judged on correctness first — exact arithmetic and, where possible, a machine-checked proof — and only then on speed.

Our work spans mathematical optimization, numerical computing, and applied machine learning research, with an emphasis on efficiency, reproducibility, and transparency at every stage. Where a result depends on a mathematical proof, we formally verify it using the Lean 4 theorem prover and its Mathlib library, so correctness does not rest on manual review alone — what that verification actually looks like, tier by tier, is on Methodology.

We also look ahead to concerns that will define the next decade of computing: cryptography that remains secure once large-scale quantum computers exist, and quantum-inspired algorithms that bring ideas from quantum computing to hardware available today.

The software is the instrument, not the product. We write a good deal of it, but it is not what we publish. The distinction is the same one an observatory makes: the telescope is built with great care and it is not the finding. Ours is an instrument for mathematics, we point it at a problem, and what appears on this site is its output — a result, a refutation, a limit we ran into — alongside enough of the method that you can disagree with it. Judge the output. The instrument is only interesting insofar as you have reason to trust what came out of it, which is why every finding here says how far it was verified and by what.

In spirit this is closer to a small independent institute than to a typical company: a private company that publishes its research openly, and builds instruments made of mathematics and software rather than products.

The path here started somewhere else. While working at a company in the education sector, Joel was promoted from team lead into security — eventually CISO — and had to learn, hands-on, how every phase of building an application actually connects, security most of all. That wasn't training taken in advance; it was a role that demanded it, so the study happened on the job.

Along the way he found a community of people on a cybersecurity study platform, competing together in CTF challenges. That's where the passion took hold: work that felt fair and genuinely recognized, a path toward a better future, and above all a growing curiosity about technology itself. Everyone in that group ended up finding their own path forward from there; Joel kept following his specifically toward security research. What became KodamaSEC is the result of a lot of persistence on that path — plenty of mistakes made, and made again, falling down and getting back up each time.

KodamaSEC Labs Ltd will not sell cybersecurity products, services, consultancy, audits, training or studies — and will not enter any commercial relationship connected to cybersecurity. Not now, and not later. This is not a description of our current stage that a change of circumstances could quietly revise; it is the shape of the thing. Section 1 of the Legal Notice already commits to announcing publicly and re-dating that page if we ever take on commercial activity of any kind. This paragraph narrows that further: for cybersecurity specifically, there is no version of the future in which the answer changes.

What we do instead is publish. Findings, replications, corrections, and informative writing about risks that are still over the horizon — particularly where they only become visible when several disciplines are read together, which is most of the interesting ones. Publishing is free to read, free to check, and free to disagree with. Nobody is asked for anything.

Regulated public bodies in the United Kingdom and Spain are given access on request, as fast as we can arrange it — to the platforms, to the source of this website, and to the internal tooling behind the research. Not a redacted summary and not a demonstration: the working material. Write from an official address to oficial@kodamaseclabs.com. We would rather be read carefully by a regulator than admired at a distance.

If this site reads as unusually heavy with verification and legal text, here is the reason, and it is not the one that might come to mind. It is not to look impressive, and it is not to talk anyone into trusting something that should not be trusted. It is the opposite. An independent developer, working alone, whose background touches security, does not get to be taken at their word — and should not be. So as far as we can manage it, nothing on this site rests on our word. That is the whole design, not a slogan: the code that runs this page is self-hosted and inspectable, with nothing loaded from a third party at run time — check your own Network tab; a full suite of automated checks runs before every deploy and the number that fail is published in the seal at the foot of every page; every research finding carries the level at which it is known, and a good share of them are refutations we kept on purpose so nobody walks those roads again, us included; and an integrity manifest lets anyone recompute the hashes of what we serve. That is what “not just talk” has to mean for someone in this position: not a promise of good faith, but a site deliberately built so you do not have to take the promise.

We supply cybersecurity to no one (see the Terms), and the engine behind the research is not published. If any of this work is ever taken in a security direction, it will be under the orientation of Spain’s own institutions — INCIBE first, and the relevant Spanish authorities — and not a step ahead of them. That is what “Spain is the first door” means in practice: oficial@kodamaseclabs.com.

And the ordinary truth underneath all of it: this is one person doing the work carefully, and one person gets things wrong. When that happens the fix is to correct it in the open and say what changed, never to reword it into something that cannot be checked. Guidance from INCIBE, from the AEPD, or from any Spanish body willing to give it is not something we would merely accept — it is something we are asking for, because doing this properly matters more than looking as though we already had.

The company earns nothing and is funded out of its director's own pocket. It exists because a surprising amount of research infrastructure is closed to a person and open to an organisation: computing platforms whose terms of service only contemplate a legal entity, instruments and datasets that will not accept an individual's registration, tooling priced and licensed for institutions. Several of those also want an organisational domain rather than a personal address before they will talk to you at all.

So the company is a key, and that is the whole of it. It grants no authority, certifies nothing, and is not evidence that anything published here is correct. A registered company that publishes a wrong result has published a wrong result.

What follows is not a summary written for this page. It is the founder’s statement of record, reproduced in full from the Legal Notice, where each commitment is binding. It is one file serving two pages, so it cannot say one thing here and something slightly different there.

And because a statement you cannot check against the clause it summarises is just a press release, here is which clause carries which promise:

• Never sells cybersecurity — and supplies none of it to anyone, paid or unpaid — Legal Notice 4A3
• One exception, in one direction: a Spanish official body, including access to the code — Legal Notice 4A3
• No political message, no statement against any religion or any group of people, for any price — Legal Notice 4A2
• Spanish rules first; nothing advances that does not comply with them — Legal Notice 4A4
• Registered in London and bound by its law; decisions taken in Tenerife — Legal Notice 4A4
• If commercial activity ever begins, it is announced publicly and this is re-dated — Legal Notice 1

If any of that turns out to be wrong, out of date, or stronger than the evidence behind it, write to @KodamaSecLabs and it gets corrected with a note saying what changed.

This site would not be one percent of what it is without AI. On my own it would have taken decades — not a figure of speech, an estimate I stand behind. I would rather write that down than let anyone assume a lone developer produced all of it by hand. What the AI does not supply is the judgement: what is worth building, what counts as verified, when a result should be thrown away, and when a number is not good enough to publish. Those calls are mine, and so are the mistakes in them — several of which are written up on this site under my own name.

The programming is not new. The first line goes back to age eleven, and there are witnesses who thought that was a strange way for a child to spend an afternoon; I was called odd for it, fairly enough. Programming has fascinated me from the first day without a gap since.

The method is older than this lab, and it is the reason any of this exists. I like using the error as the pivot. Rather than treating a failure as something to suppress, take it as the input that adjusts the method, recursively, until the thing tunes itself — usually with algorithms nobody would call conventional, because the conventional one has already declined. It is the same instinct as pushing a change to production just to see how it lands on the front end, except the change is a piece of mathematics. Trying mathematics that way has always turned up something curious, and more often than not something genuinely fun.

Independent research that has not been reviewed is a claim, not a result. Rather than say that in the abstract, here is the specific list of skills the work needs in order to be sound, scored against how much of each actually exists today. Every score is anchored to something that has already happened here — a retraction, an error found after publication, a distinction stated wrongly, a stack of proved findings nobody has written up — and each row says which.

The bar is what exists; the empty part is what does not. The track’s width is how much the soundness of our published work depends on that skill, so a wide bar that is nearly empty is the loudest thing on this page, and is meant to be.

On the mathematics, at the bottom. No degree in it, no training in it, and gaps that are real and occasionally embarrassing — the sort that come from learning a subject in the order curiosity hands it to you rather than the order a syllabus would. Level 1 of 5 on every row above the writing line, and that is the honest number, not a modest one. Anyone on this list who does this professionally is better qualified in their field than the person who started the project, and the project is arranged on that assumption.

Which is why nothing here rests on anyone taking his word. Results are machine-checked or they are marked as not; the working is published so it can be broken; corrections go up the same day with their own dates. That is not modesty, it is the only arrangement under which an unqualified person can do this at all without misleading somebody.

What he does supply is the two rows near the bottom of the chart — the platform, the security, the tooling, the tests — and the part that is not a skill at all: paying for it, keeping it running, and putting the results where people with real judgement can reach them. Less a researcher than a bridge between people who have the criteria and the capability, and the digital groundwork that lets them use it. Some of what has been found here is frankly the arithmetic of persistence and luck rather than insight, and saying so costs nothing that was worth having.

Nothing on this page is a job advertisement, and nothing is being offered or asked for. It is an inventory, published because a gap you can see is worth more than one you have to guess at — and because anyone deciding how much weight to put on our results deserves to know exactly where they are thin.