I do deep commit-level analysis on actively maintained open source projects — looking for behavioral contract changes that slip past code review: silent return value mutations, exception scope widening, broken caller assumptions, wrong entity types in API calls.
When I find something real, I report it with a reproducible description and a suggested fix.
Full writeups with code → oss-findings
| Date | Repo | What | Severity | Status |
|---|---|---|---|---|
| Jun 16 | magento/magento2 | #40882 — NoSuchEntityException race in InvalidSkuProcessor bulk price API |
🔴 High | ⏳ PR #40883 |
| Jun 5 | codeceptjs/CodeceptJS | PR #5639 — --shuffle flag silently ignored after commit #5438 |
🔴 High | ✅ Merged |
| Jun 14 | midjourney-api | #294 — ChannelId used as ServerId in guild API |
🔴 High | ⏳ Open |
| Jun 14 | midjourney-api | #295 — Dead code in cacheCommand(), cache never populated |
🟡 Medium | ⏳ Open |
| Jun 14 | bagisto/bagisto | #11338 — getClientOriginalName() path traversal in RMAImageRepository — incomplete security fix |
🔴 Critical | ⏳ Open |
| Jun 14 | bagisto/bagisto | #11339 — v-html XSS in Shop views — product_name + datagrid columns unescaped |
🔴 High | ⏳ Open |
| Jun 13 | MoneyPrinterTurbo | PR #1033 — CLI local source validation fix | 🟡 Medium | ✅ Merged |
| Jun 10 | MoneyPrinterTurbo | #1013 — Groq model unvalidated on list-fetch failure | 🟡 Medium | ✅ Fixed PR #1014 |
| Jun 4 | medusajs/medusa | Discussion #15550 — Race condition in compensatePaymentIfNeededStep |
🔴 High | 👀 Watching |
| Jun 4 | MoneyPrinterTurbo | #985 — >= comparison risk in duration check |
🟡 Medium | 👀 Community PR expected |
| Jun 4 | MoneyPrinterTurbo | #984 — Qwen empty choices[] — unhandled crash |
🔴 High | ✅ Fixed PR #994 |
| Jun 4 | Understand-Anything | Discussion — commit analysis findings | 🟡 Medium | 👀 Watching |
| Repository | Language | Stars | Finding |
|---|---|---|---|
| harry0703/MoneyPrinterTurbo | Python | 22K+ | 3 bugs found, 3 fixed |
| medusajs/medusa | TypeScript | 28K+ | Race condition in async workflow step |
| erictik/midjourney-api | TypeScript | 1.8K | 2 bugs found |
| apify/crawlee-python | Python | 9K+ | Silent URL filtering behavior change |
| tox-dev/tox | Python | 4K+ | Config override namespace risk |
| gptme/gptme | Python | 4K+ | LLM routing logic analysis |
| Lum1104/Understand-Anything | Python | — | Commit analysis findings |
| acacode/swagger-typescript-api | TypeScript | 4K+ | Analyzed — no actionable findings |
| bagisto/bagisto | PHP | 9.1K+ | 2 security bugs found |
| aws/aws-sam-cli | Python | 6.7K | Analyzed — no actionable findings |
| codeceptjs/CodeceptJS | JavaScript | 10K+ | shuffle regression — PR #5639 merged ✅ |
| magento/magento2 | PHP | 14K+ | NoSuchEntityException race condition in bulk price API |
Issues Opened ████████░░ 10
PRs Submitted ███░░░░░░░ 3
PRs Merged ████░░░░░░ 4 ← accepted by maintainers
Discussions ██░░░░░░░░ 2
Repos Analyzed ██████████ 12
Confirmed Bugs █████░░░░░ 6