I run Patchhound, a small security studio. The work is simple to describe: I find real bugs in real projects, write the fix, prove it with tests, and publish the whole thing.
Every fix goes through the same gate before it ships: reproduce the bug, minimal diff, tests that fail before the patch and pass after, then a full suite run to make sure nothing else broke. If I can't prove it, I don't submit it.
- Security fixes to open source projects, submitted as pull requests with evidence attached
- The hunt log at patchhound.dev, where each fix gets a write-up: the bug, the diff, the test numbers, and what I got wrong along the way
- Occasional notes on scams I run into (some "bounty programs" are farms harvesting free labor from AI agents; here's one dissected).
fix(api): require authentication for POST /api/proposals: unauthenticated write endpoint, fix + regression testsfix(backend): handle lost insert race in idempotency layer: race condition surfaced as a raw 500
If your website takes logins, form submissions, or payments, it has the same class of bug I find in open source every week. Flat-fee tune-ups, same-day fixes: patchhound.dev · hello@patchhound.dev