Live counts, straight from GitHub search. Only other people's repositories are counted.
▶ Gunslash Arena — wall-run, double jump, dash, slash, shoot. Eight bots that fight each other too. It starts the moment the page opens.
A third-person arena built from scratch in three.js, no engine, no install. The mansion, the textures, the effects and every sound are generated in code; the fighters and their animations are Kay Lousberg's CC0 KayKit Adventurers. Source. Keyboard and mouse.
I hunt the bugs that survive code review and only detonate in production — the ones a second replica exposes, the ones a policy engine quietly hides, the ones that spin forever without ever throwing. Then I prove them.
+ Read the codebase until the failure mode is obvious
+ Write the test that FAILS on main
+ Fix it in the smallest diff the maintainers would have written themselves
+ Watch that same test PASS
- No padding. No drive-by nitpicks. No "looks good to me" reviews.
Rendered in Blender with Cycles, like the header. Every motion completes a whole number of cycles per loop, so it never seams.
| Project | Landed | The bug |
|---|---|---|
| CopilotKit/OpenBot AI coworker platform |
 #3 of 24 contributors |
A snapshot cache living in process memory meant element refs silently stopped resolving the moment a second replica existed — moved it into Postgres. A deny rule written for one action surface refused every other surface too. An audit page that called a refused call "Allowed". An empty PORT in the environment that let the server come up on a random port. |
| edwardkim/rhwp Rust document engine |
 #4 of 58 · 960+ commits |
Rendering fidelity against ground-truth documents, the CLI & agent surface, a privately reported path escape in font embedding, and a long campaign of static-analysis panic & DoS fixes. |
| leookun/cursor-byok Local Cursor backend |
  #2 of 24 contributors |
A tool-call id reused across rounds wedged the run forever, with no timeout on that path. Result truncation that spun at 100% CPU, then underflowed a usize. One unreadable proxy row that bricked every request. Empty tool arguments that killed the entire run with EOF while parsing a value. Also: the repo's first pull-request CI, so main stops drifting red. |
| crmne/fastpotify Native Spotify client in Rust |
  #7 of 23 contributors |
A skin colour with a multi-byte character panicked the parser, and release builds abort on panic, so the app just closed. On Windows the locale is empty, so every Japanese, Korean and Traditional-Chinese user got three mismatched fallback fonts — the Han region now comes from the Windows display language. A byte order mark, the thing Notepad writes, silently threw away every colour in a skin. |
| lightningpixel/modly Image to 3D desktop app |
  |
Headless runs wrote their results into an unindexed folder the app could never see. The "free the GPU" step ran only on the rare max-iterations exit — dead code on the path that mattered. A tool that reported a failed model unload as success. |
| pacifio/atlas Source control for agents |
  |
A CI matrix that had quietly skipped one crate while its clippy denies turned every push red. A midnight-boundary fixture pinned to UTC that failed in every other timezone. In review: a PATH patch that split on :, so every agent server on Windows inherited a corrupted PATH, and a dependency that cannot compile under MSVC at all. |
| nolight132/sonora Native music client, Rust + GPUI |
  |
The local library scanner stored no "date added" at all, so the column sat empty and sorting by it did nothing — now filled from the file's modification time. The toolchain file left out clippy, so the lint command the contributing guide asks for failed on every fresh checkout. |
| xevrion/breakscale Distributed-systems failure simulator |
  |
A shared link could carry an instance count the inspector never allows; Math.max(1, NaN) is still NaN, so the simulator tried to allocate a billion-slot array on its first snapshot and died. Found by measuring every inspector knob against its declared range. |
| shy3130/tick-stock-panel A-share quant workbench |
 |
A forced-exit signal evaporated under pandas copy-on-write — chained assignment, dropped without a warning. An upload handler read whole files into memory with no cap at all. |
| akitaonrails/ai-memory Long-term memory for agent CLIs |
 |
A packaging test that could never pass on Windows — found by running the suite where CI does not. |
| cactus-compute/needle 14 MB on-device tool-calling model |
 |
The engine moved its cache into a versioned folder and the test harness kept looking at the old path, so every engine test skipped silently even with the engine installed. The playground reset the wrong engine, so "clear conversation" kept the previous turns. Extraction dropped the system facts the docs say it needs to resolve "yesterday". |
| ZSeven-W/openpencil AI-native vector design tool |
 |
Five Windows fixes for the agent layer: executables probed without their .exe/.cmd extensions, environment allowlists that miss natively-cased Windows variables, restored blobs addressed with the wrong path separator. |
| NVIDIA/SkillSpector Security scanner for agent skills |
 |
A Windows path with an 8.3 short name in it failed the handle-path safety check, so on any account with a space in its name, %TEMP% is short-form and every URL scan broke by default. |
|
A deterministic document runtime for agents. DOCX, ODT, Markdown, HTML,
PDF/A — plus Korean HWP, HWPX and HML. One integer layout engine, so the
same fonts give the same PDF/A bytes every time. Agents call
|
Ask patent questions in plain language. Get answers with the measurement shown, not asserted. No API key, no install — stdlib only. Its agent sibling: patent-scout-agent. |
|
A local-first browser workbench for Korean HWPX and HWP documents: open, inspect, repair, edit and convert, with no Hancom install. Live demo. |
A live treemap of exactly what your AI coding agent is doing to your disk. One file, no dependencies, read-only. |
|
A Ring household that checks in on itself — it knocks with a chime before it alarms the family, and any sign of life counts as an answer. Demo · Devpost. |
Cats, dogs and pigs in a real-time .io arena, live on Google Play and in the browser. Bots keep every room full, so it is always playable. |
|
Ask out loud which public funding you can actually apply for. A self-hosted MCP server over grants.gov that refuses to guess. |
After the agent says it is done — prove the work actually happened. Fails closed. |
|
Try a financial product before you sign it: the contract split into clauses, risk flags, and early-exit, fee and rate scenarios in your own numbers. A 2026 Financial AI Challenge entry. |
Payout dates, net income and a 30-day balance forecast for people paid by platforms. Runs entirely in the browser, nothing leaves it. |
Also on the shelf: balju-radar (a weekly lead report on public tenders) · github-trending-daily (GitHub Trending, snapshotted daily by Playwright on Actions) · hackathon prototypes protocol-sift-sentinel, zipcode-cloud-relay and shortsflow-ops-agent.
Every tower is one real day from my contribution calendar, rendered in Blender with Cycles. Click it to fly through the live WebGL version — drag to orbit, hover a tower for the day.
A maintainer closed one of my pull requests with: "Closing this as already landed, but you found a real bug and got there independently."
The fix had shipped inside someone else's PR — after I left a review pointing at the exact failure mode.
That is the job. Not the badge on the pull request — the bug being gone.
The reviews I leave are the ones I would stake my name on. Silence otherwise.
Everything that moves on this page is rendered with Blender (bpy + Cycles) from scripts in this repo, or drawn by GitHub Actions from live data. No JavaScript runs here — the WebGL version lives next door.