Loading...
Open source
Most of my open-source time goes into the payment, webhook and auth libraries that products like mine depend on. I report what is wrong, write the fix or review someone else's, and the maintainers decide. Everything below links to the public record.
Live from GitHub, refreshed hourly
GitHub profile6
Fixes merged
Pull requests I wrote, merged by maintainers; 7 more in review
25
Pull requests reviewed
Across 20 projects; 9 merged after the review
11
Issues reported
5 already fixed upstream
36
Other projects
Including Adyen, Go, Twilio, Google, Medusa and the MCP SDKs
Highlights
Work in other projects that their maintainers merged or changed because of it.
Reported and fixed
Reported that the Node HMAC validator accepted a malformed key as an empty one. Adyen confirmed it and asked for fixes across its SDKs: merged in Node, Java and .NET, with PHP, Python, Go and Ruby in review.
Activity
Public events from my GitHub account. Work in someone else's repository is marked Upstream.
Opened pull request #382 in ratomirjovanovic/pandaward
Opened issue #381 in ratomirjovanovic/pandaward
Run the taint engine by default and remove its false positive shapes
Full record
Read from GitHub search. My own repositories and organisations are left out.
standard-webhooks/standard-webhooks
#354 php: fix Webhook::fromRaw() after the empty secret checkMerged13 Nov 2026
Adyen/adyen-dotnet-api-library
#1899 fix(hmac): reject an empty HMAC keyMerged3 Nov 2026
Adyen/adyen-node-api-library
My projects
Application security assessment for your own repositories that also tells you what it did not test. A ledger of every control it checked, with redacted, SHA-256 addressed evidence, and every control it could not decide. Passive by default. Reports in HTML, Markdown, JSON, SARIF and CSV, reproducible release binaries with an SBOM and signed provenance.
Paste an API response, webhook or postback and see what the provider reported, what the code means, which events belong together and what looks wrong. Card processors, wallets, pay-by-bank and crypto. Nothing leaves the browser.
Official client libraries for the Payshen payment orchestration API: payments, captures, voids, refunds, events and webhook verification, published on four registries.
Fix merged
Reviewed binary payload signing, merged with the memoryview fix the review asked for, then fixed Webhook::fromRaw in the PHP library after the empty secret check.
Reported and fixed
Reported that oauth2.DeviceAccessToken panics when a server returns a negative or very large polling interval; fixed in golang.org/x/oauth2.
Review adopted
On Vertex AI the access token would still have followed a redirect to another domain, because the auth transport signs every hop again. The author adopted the fix in the PR.
Review adopted
HMAC-SHA256 webhook support in twilio-node: the Express middleware still checked SHA-1 only. Twilio fixed it in the PR and merged it.
Review adopted
Network errors would have carried the API key secret into application logs. Fixed in the PR with tests.
Reported and fixed
Reported that payment providers removed from config were never disabled, and reviewed the refund fix that recomputes the refunded amount when a refund fails at the provider. Both fixed and merged.
Review adopted
Reviewed the Go SDK client credentials flow; merged after revision.
Review adopted
Reviewed v6 script reuse across namespaces in paypal-js; adopted in the PR.
Merged pull request #379 in ratomirjovanovic/pandaward
Upstream
Opened pull request #398 in mollie/mollie-api-python
Upstream
Opened issue #1991 in stripe/stripe-python
WebhookSignature.verify_header raises TypeError for a non-ASCII v1 signature
Upstream
Opened pull request #436 in blnkfinance/blnk
Merged pull request #378 in ratomirjovanovic/pandaward
Merged pull request #377 in ratomirjovanovic/pandaward
Opened pull request #380 in ratomirjovanovic/pandaward
Upstream
Opened pull request #1928 in moov-io/ach
Opened pull request #379 in ratomirjovanovic/pandaward
Merged pull request #376 in ratomirjovanovic/pandaward
Closed issue #374 in ratomirjovanovic/pandaward
gitleaks walks excluded directories and times out on large build trees
Merged pull request #375 in ratomirjovanovic/pandaward
Merged3 Nov 2026
Adyen/adyen-java-api-library
#2100 fix(hmac): don't include the HMAC key in the invalid key exceptionMerged3 Nov 2026
svix/svix-webhooks
#2768 php: fix Webhook::fromRawMerged30 Oct 2026
svix/svix-webhooks
#2765 php: reject an empty or non-base64 webhook secretMerged29 Oct 2026
Open
mollie/mollie-api-python
#398 Fix testmode when following pagination and _links URLsOpen
Adyen/adyen-php-api-library
#976 fix(hmac): don't include the HMAC key in exception messagesOpen
Adyen/adyen-ruby-api-library
#410 fix(hmac): reject an empty HMAC keyOpen
Adyen/adyen-go-api-library
#607 fix(hmacvalidator): reject an empty HMAC keyOpen
Adyen/adyen-python-api-library
#515 fix(util): reject an empty HMAC keyOpen
modelcontextprotocol/rust-sdk
#1450 fix(auth): avoid refreshing short-lived access tokens on every callOpen
Open
razorpay/razorpay-node
#492 Preserve network errors when the API does not respondOpen
Merged10 Nov 2026
Open
googleapis/go-genai
#1024 fix: strip the API key from a redirect to another domainOpen
better-auth/better-auth
#12049 fix(account): share and guard concurrent provider token refreshesOpen
Open
twilio/twilio-node
#1226 chore: support HMAC-SHA256 webhook signatures in validateRequestMerged5 Nov 2026
better-auth/better-auth
#12014 fix(stripe): refetch subscription in subscription webhooksClosed
DataDog/dd-trace-js
#10932 fix(appsec): wrap shared Stripe webhooks methods only onceClosed
Open
standard-webhooks/standard-webhooks
#348 Sign binary payloads byte for byte (JavaScript, Python)Merged29 Oct 2026
modelcontextprotocol/go-sdk
#1451 auth/extauth: send resource in client credentials token requestsMerged28 Oct 2026
juspay/hyperswitch-web
#1829 fix: preserve 3DS messages before closing fullscreen framesMerged28 Oct 2026
Merged27 Oct 2026
Closed
Adyen/adyen-web
#4273 Fix/prevent duplicate 3DS2 challenge completionMerged27 Oct 2026
anthropics/anthropic-sdk-typescript
#1284 fix(client): keep the abort listener while the Response is heldOpen
razorpay/razorpay-node
#495 fix(security): use constant-time comparison for webhook signature validation [closes #479]Open
Merged27 Oct 2026
juspay/hyperswitch-web
#1824 fix: validate payment postMessage origins and sourcesMerged27 Oct 2026
stripe/stripe-node
#2848 Preserve endpointFetch response headersOpen
Open
stripe/stripe-react-native
#2752 fix(payment): map phone, carrier, and trackingNumber in shippingDetailsOpen
stripe/stripe-python
#1991 WebhookSignature.verify_header raises TypeError for a non-ASCII v1 signatureOpen
modelcontextprotocol/rust-sdk
#1442 auth: tokens that live 30s or less are refreshed on every requestOpen
Fixed6 Nov 2026
Open
Adyen/adyen-node-api-library
#1816 [Bug]: HmacValidator accepts a malformed HMAC key as an empty keyFixed4 Nov 2026
cashfree/cashfree-pg-sdk-nodejs
#133 PGVerifyWebhookSignature never checks x-webhook-timestamp, so an old webhook verifies foreverOpen
payloadcms/payload
#19055 plugin-ecommerce: restore the Stripe cart drift check with a metadata digest, and keep shippingAddress under the metadata limitOpen
Open
svix/svix-webhooks
#2763 php: Webhook accepts an empty or non-base64 secret and verifies with an empty HMAC keyFixed29 Oct 2026
medusajs/medusa
#17544 [Bug]: Payment providers removed from config are never disabled in payment_providerFixed28 Oct 2026
supabase/ssr
#209 tsconfig.json: outDir without rootDir triggers TS6059 / migration warning when validated by IDEFixed4 May 2026