I'm Cole. I work on embedded and firmware security: kernel drivers, device firmware, and the RF/SDR stack around them. I also build open-source tools and contribute upstream wherever correctness matters, from accessibility to health tech. I write up the interesting bugs on my build log.
Most of these are MIT; the big apps are free for noncommercial use. Almost everything runs with zero dependencies, and most come with a live demo you can try in your browser right now, no install and no account. Pick whichever fits; each repo has the full story.
- Friends and family on your map, nobody else → starling
- Vetting an AI agent skill before you install it → skillxray
- Writing an MCP server → toolsmell for the tool descriptions, webmcp-lint if it's WebMCP in a page
- Seeing what your agent actually touched on a run → sessionxray
- Screenshots feeding a vision agent → framewall to scan them, injection-fixtures to test your defense
- Shipping a translated app → translint
- GitHub Actions → wouldrun for what fires, actbreak to break into a step, ci-safety-gate to gate the repo
- Checking a research-peptide COA → coacheck
- Cheapest way to travel → hopandhaul
- Strength-training math → liftmath
- A daily puzzle habit → puzzlepress
| Project | What it does |
|---|---|
| starling | Private location sharing for friends and family, like Life360 without the company in the middle. Positions are encrypted on your device with AES-256-GCM under keys derived from an invite link that never reaches a server; the relay stores ciphertext and deletes it after 24 hours. An Android app with background sharing, fingerprint app lock, panic wipe, and Orbot support. The relay is small and self-hostable, and release builds are reproducible. |
| hopandhaul | Finds when flying into a cheaper hub and taking the train the rest of the way beats flying direct. Click-the-map planner that runs in your browser with no install, 4,175 airports, UI in 46 languages. |
| liftmath | Gym math with receipts: a 1RM estimate from any set you just did, plate loading with a barbell that loads itself as you type, and Wilks/DOTS/IPF strength scores, plus a searchable record book for powerlifting, strongman, grip sport, and track and field. A web app plus a CLI. |
| puzzlepress | Seven daily puzzle games in your browser: a word guesser, group sorting, a pangram hunt, a mini crossword with hand-written clues, a themed word search, letter chains, and sudoku. Installable as an app. No accounts, no ads, no tracking, zero dependencies, and every puzzle bank ships in the repo. |
| translint | A linter for your translation files. Catches missing keys, placeholder mismatches, and untranslated values before they ship. CLI, CI gate, pre-commit, or agent skill. Its site practices what it lints: 32 languages, RTL included. |
| skillxray | Reads an AI agent skill before you install it and flags what's hiding: prompt injection, invisible Unicode, curl-pipe-sh and reverse shells, credential theft, leaked keys. Then grades it A to F. SARIF for the GitHub Security tab, exit codes for CI. Python, zero dependencies. |
| actbreak | A breakpoint debugger for GitHub Actions. Wraps act to pause a workflow mid-step, drop you into a live shell inside the job container, and resume when you're done. Python, zero dependencies. |
| webmcp-devtools | A Chrome DevTools panel that inspects and security-lints the WebMCP tools a web page hands to AI agents: a live tool table, a call-history timeline, and per-tool tool-poisoning checks. Plain JavaScript, no build step. |
| webmcp-lint | The same idea as a CI gate: lints a WebMCP tool manifest against Chrome's own security guidance before you ship it. Read-only hints, untrusted-content flags, injection in tool descriptions, unconstrained parameters. Human, JSON, or SARIF out. Python, zero dependencies. |
| framewall | Scans a screenshot for prompt injection a person would miss but a vision model reads: hidden low-contrast text, fake system-message overlays, instructions buried in image metadata, all before your agent acts on it. Reads the text with OCR when tesseract is around and falls back to image heuristics when it isn't. Python, Pillow only. |
| injection-fixtures | Known visual prompt-injection payloads packaged as pytest fixtures, so anyone building a screenshot or computer-use agent can test their defenses against poisoned images right in CI. Installs straight from the repo with pip install git+https://github.com/munzzyy/injection-fixtures, Pillow only. |
| sessionxray | Audits a Claude Code session transcript after the fact and tells you what the agent actually touched: files outside the project, unexpected outbound hosts, secret reads, destructive commands. A security lens on your own agent's run, all local. Python, zero dependencies. |
| toolsmell | Finds the smells in an MCP server's tool descriptions and schemas: the vague verbs, undocumented parameters, and missing return docs that quietly make agents worse at using your tools. For authors, before you publish. Python, zero dependencies. |
| wouldrun | Answers which GitHub Actions workflows would fire for a given diff or event, statically, without pushing or running act. Resolves triggers, branch and path filters, and reusable-workflow calls, and says why each one runs or doesn't. Python, zero dependencies. |
| ci-safety-gate | One GitHub Action that runs the checks an AI-era repo wants: zizmor for workflow security, skillxray for agent skills, and a secrets scan, all as a single pass-or-fail gate with one combined report. |
| coacheck | Reads a research-peptide Certificate of Analysis and does the math: real deliverable purity from the labeled amount, a red-flag checklist for thin or faked COAs, and reconstitution down to syringe units. A calculator, not advice. Python, zero dependencies. |
They're all open to contributors. Each one ships a CONTRIBUTING file with the setup and the house rules, and the issue trackers are open, so if something is broken or missing, file it and I'll pick it up. Stars genuinely help other people find them.
More than 125 have landed upstream and over sixty more are open, across nearly seventy projects: correctness, security, RF/SDR, firmware, hardware docs, accessibility, and translation. That includes the Flipper One's MCU firmware, where I'm one of the ten people with code in the tree before the device ships, its Linux kernel, where a device-tree fix of mine is merged and now sitting on the mainline list, and its U-Boot, which applied my btrfs zstd fix from the mainline U-Boot list. Mainline U-Boot itself now carries three more btrfs patches of mine, reviewed by a btrfs maintainer and applied by the project's lead, and the Rockchip custodian tree just took a two-patch SPI series of mine for devices with no wire in one direction, written for the Flipper One's display bus. The two Flipper devices are different machines, so I count them separately: the Flipper One side is 22 merged and 11 open across its kernel, MCU firmware, debug probe, corelibs and docs, and the Flipper Zero side is 8 merged and 5 open across the firmware, apps and catalog. A few that were fun to track down: a stack overread in GNU cpio's tar parser you could hit with a plain cpio -itv, a heap out-of-bounds read parsing short iCLASS dumps, byte-order corruption in RFID dump files, authenticode digest buffers that were never null-terminated in YARA, a flipped GPS hemisphere in a photo-evidence app, a use-after-free that fired the moment a run-once event subscription cleaned itself up, and a hard fault you could trigger by unplugging USB mid-command.
The BUSY Bar shipped in July 2026, so the firmware is young and the bugs are still live. Three I found went upstream together in busy-app/busybar-firmware #905, which the team wrote themselves from my reports and patches:
| Change | How it got there |
|---|---|
A zero-size allocation in the JS runner, where furi_check turns malloc(0) into a reboot, so console.log("") restarts the device |
reported and patched in #903, reimplemented by the team |
| An error string in the HTTP display API leaked on the success path | reported and patched in #904, reimplemented by the team |
| A missing union tag in the draw API | reported privately to their security address, fixed in the same PR |
Also traced why pip install busylib hands you a version that refuses to talk to current firmware: 1.1.0 and 1.2.0 are tagged on GitHub but were never published to PyPI, so pip can only ever reach 1.0.0.
| Repo | Change |
|---|---|
| u-boot/custodians/u-boot-rockchip | Support SPI devices with no wire in one direction: a two-patch series applied for the 2027.01 cycle, written for the Flipper One's display bus, where the missing MISO pin doubles as the end-of-frame GPIO |
| GNU cpio | Stack out-of-bounds read parsing unterminated tar uname/gname fields, reachable from cpio -itv; reported with a repro and patch, fixed upstream by the maintainer |
| flipperdevices/flipper-linux-kernel | Add the missing cache hierarchy to the RK3576 CPU nodes, so Linux stops reporting the Flipper One with no caches |
| flipperdevices/flipper-linux-kernel | Register the Flipper One's side-button interrupt in the MCU MFD driver |
| flipperdevices/flipper-linux-kernel | Wire the Type-C up port's VBUS supply to the connector so the USB mux can actually switch it |
| u-boot/u-boot | Report file sizes from btrfs readdir, with a path-release fix and a shared size helper: three patches in mainline U-Boot, reviewed by a btrfs maintainer |
| flipperdevices/u-boot | Fix btrfs zstd decompression of compressed inline extents, applied from my mainline U-Boot patch |
| flipperdevices/flipperzero-firmware | Initialize timings_cnt on infrared decoder alloc and fix its bounds check |
| flipperdevices/flipperzero-firmware | Check the NFC poller error before reading a FeliCa system-code response |
| flipperdevices/flipperzero-firmware | NUL-terminate the PAC/Stanley card id before parsing it |
| flipperdevices/flipperzero-firmware | Fix the trailing Wiegand parity bit on Pyramid LFRFID cards |
| flipperdevices/flipperone-mcu-firmware | Stop the main GPIO expander's reset path using a freed handle when re-initialization fails |
| flipperdevices/flipperone-mcu-firmware | Fail the haptic driver's auto-calibration when its status register says it failed |
| flipperdevices/flipperone-mcu-firmware | Leave the I2C slave critical section on the early return |
| flipperdevices/flipperone-mcu-firmware | Check for NULL before dereferencing in serial deinit |
| flipperdevices/flipperone-mcu-firmware | Remove a double pipe_free in the CLI UART disable handler |
| flipperdevices/flipperone-mcu-firmware | Fix a hard fault in the Flipper One CLI when USB disconnects mid-screen |
| flipperdevices/flipperone-mcu-firmware | Stop a wild pointer reaching the Flipper One's device-info callback |
| flipperdevices/fbtng-corelibs | Fix a use-after-free in the event loop when a run-once subscription fires |
| flipperdevices/fbtng-corelibs | Fix an out-of-bounds read in bit_lib when the requested bits fit one byte |
| flipperdevices/flipperzero-good-faps | Add the missing terminator to the SPI-mem chip table |
| VirusTotal/yara | Null-terminate authenticode digest/thumbprint hex buffers |
| VirusTotal/yara | Fix a string leak in CLI args_free |
| VirusTotal/yara | Honor -w/--no-warnings for the file-too-large skip message |
| VirusTotal/yara | Reject hex jump and repeat lengths that overflow an int |
| VirusTotal/yara | Document the YR_RE_SCAN_LIMIT regular-expression scan limit |
| ffuf/ffuf | Stop terminal control characters leaking into redirected output |
| gpac/gpac | Fix four more strchr scan loops that read past the end of the buffer, two reachable from a crafted file, finishing a sweep upstream had started |
| chimera-nas/libevpl | Stop the HTTP server freeing a client's in-flight request twice when the client disconnects mid-request |
| chimera-nas/libevpl | Keep the iovec ring's waist in bounds when the ring grows |
| YARAHQ/yara-forge | Align indexed and patterned hash meta fields |
| SigmaHQ/sigma | Add a vmmemWSL exception to the non-existing-file rule |
| splunk/security_content | Add a PreAuthType filter to the PetitPotam Kerberos detection |
| splunk/security_content | Fix a wildcard declared on a column that doesn't exist in the malware user-agent lookup |
| openmls/openmls | Sign the GroupInfo with the new key when a commit rotates the signature key, so joiners can verify it |
| openmls/openmls | Stop FrankenProposal's length counting the proposal type twice |
| cake-tech/trezor-flutter | Decode a THP packet that exactly fills the packet size |
| monero-project/monero | Keep the additional-derivations list aligned when one derivation fails, so later outputs are still seen as yours |
| monero-project/monero | Make sweep_account expand index=all against the account being swept, not the current one |
| monero-project/monero | Clamp the export_outputs start to the transfer count so the reserve stops underflowing |
| osquery/osquery | Scan XDG-base-directory Firefox profiles |
| osquery/osquery | Add the Windsurf .devin path to vscode_extensions |
| osquery/osquery | Add the Microsoft Edge and Flatpak paths to chrome_extensions on Linux |
| osquery/osquery | Split the sudoers header on the first unescaped whitespace, so escaped spaces in a name stop leaking into the rule |
| osquery/osquery | Fix an off-by-one bounds check in the platform_info BIOS parser |
| RfidResearchGroup/proxmark3 | Fix a heap out-of-bounds read in hf iclass view on short dumps |
| RfidResearchGroup/proxmark3 | Stop the IR56 wiegand decode leaking the header sentinel bit into the facility code |
| RfidResearchGroup/proxmark3 | Fix byte-swapped, corrupted EM 4x05 dump files |
| RfidResearchGroup/proxmark3 | More heap out-of-bounds reads on short iCLASS dump files |
| RfidResearchGroup/proxmark3 | Set the stringop-overflow guard before the bundled deps are added, so the flag actually reaches them |
| RfidResearchGroup/proxmark3 | Reject an undersized hf xerox view dump file instead of reading past the buffer |
| merbanan/rtl_433 | Fix a uint8_t offset wraparound in the m-bus payload parser |
| merbanan/rtl_433 | Restore a missing bitbuffer_clear in pulse_slicer_dmc |
| merbanan/rtl_433 | Fix swapped order/inversion nibbles in the secplus_v2 docs |
| merbanan/rtl_433 | Widen the m-bus payload offset so the AFL sub-header recursion can't wrap it |
The rest of the merged list: RF/SDR, privacy, accessibility, localization, health
| Repo | Change |
|---|---|
| f4exb/sdrangel | Bump bundled faad2 to 2.10.1 to fix a heap overflow |
| f4exb/sdrangel | Fix a crash adding a LocalSink channel with no Local Input device |
| UberGuidoZ/Flipper | Fix dead links in the Sub-GHz docs |
| PentHertz/urh-ng | Decode int8 samples as signed char so magnitudes stay correct on ARM |
| jcsteh/osara | Make paste/duplicate screen-reader messages translatable |
| guardianproject/orbot-android | Request ACCESS_LOCAL_NETWORK before opening the proxy on all interfaces |
| guardianproject/orbot-android | Fix the Bridge.doh getter reading the dot parameter, so doh= lines parse and stop growing duplicates |
| guardianproject/orbot-android | Fix bridge parsing for transport lines with no fingerprint |
| guardianproject/orbot-android | Unit tests for the bridge line parser, one case per transport the app ships |
| guardianproject/orbot-android | Normalize unicode spaces in custom bridge input |
| guardianproject/orbot-android | Add an IPv6 preference to HTTPTunnelPort |
| guardianproject/proofmode-android | Correct the C2PA GPS hemisphere on longitude and latitude |
| guardianproject/proofmode-android | Correct the bitmap stride in QR code generation |
| guardianproject/proofmode-android | Write the C2PA dc:creator as a JSON array instead of a bracketed string, so the signed CAWG metadata parses |
| flipperdevices/flipperone-debug-probe | Keep the DAP ring-buffer backpressure working after the pointers wrap, plus NULL handle derefs and a CDC error read as a huge length (#16, #15, #14) |
| flipperdevices/flipperone-docs | A docs validator for fragment anchors and broken image paths, plus microSD, charger and fuel-gauge part-number fixes (#427, #422, #421) |
| hotosm/tasking-manager | Replace Nominatim reverse geocoding with an in-database pg-nearest-city lookup |
| ooni/probe-cli | Remove a stray debug print in the feature-flag cache |
| jvoisin/mat2 | Strip APEv2 and ID3v1 tags that sit after the audio in mp3, ogg and flac |
| jvoisin/mat2 | Sort OOXML attributes themselves instead of reordering elements out of schema order |
| jvoisin/mat2 | Clean tracked moves out of docx files, which Word records as moveFrom/moveTo, not del/ins |
| jvoisin/mat2 | Stop a bare HTML5 void element like <meta charset="utf-8"> making mat2 refuse to clean the file |
| symfony/symfony | Fix the Finnish BIC/IBAN mismatch translation |
| symfony/symfony | Drop an always-true method_exists check |
| symfony/symfony | Escape backslashes in Mime's Address::getEncodedName(), so a name ending in one can't break the header quoting |
| symfony/symfony | Fix broken placeholder translations across Armenian, Arabic, Basque, Turkish, Galician, Azerbaijani, Traditional Chinese, Finnish, and Welsh |
| ghostfolio/ghostfolio | Improve the French localization |
| ghostfolio/ghostfolio | Improve the Dutch localization, again later |
| ghostfolio/ghostfolio | Fix corrupted state attributes in the Catalan and Turkish locales |
| jsverse/transloco | Respect currency in numberFormatOptions |
| simonoppowa/OpenNutriTracker | Catch silent zero-byte export writes |
| simonoppowa/OpenNutriTracker | Stop stone body weights showing a full stone worth of pounds |
| davidhealey/waistline | Guard Meals.init against overlapping calls |
| davidhealey/waistline | Distinguish rate-limit and network errors from bad USDA keys |
| osquery/osquery | Fix a one-past-end iterator deref in vscode_extensions |
| osquery/osquery | Fix the wrong key_strength reported for Windows certificates |
| osquery/osquery | Key the recursive-glob visited set on (device, inode) so symlinked trees stop being rescanned |
| projectdiscovery/nuclei-templates | Stop nfs-v3-exposed counting a PROG_UNAVAIL reply as a hit |
| projectdiscovery/nuclei-templates | Fix the nh-c2 DSL matcher that can never match |
| projectdiscovery/nuclei-templates | Stop two WordPress VR XSS templates firing on any HTML page that escapes the payload |
| monero-project/monero-gui | Fix a stale subaddress selection on the Receive page after switching accounts |
| monero-project/monero-gui | Read a restore date typed without hyphens as a date, not a block height |
| mdn/translated-content | Correct the Japanese Reflect.deleteProperty() docs |
| openfoodfacts/open-prices | Remove an unreachable branch in the barcode short-code fixups |
| openfoodfacts/open-prices | Point the prediction_count__lte filter at prediction count instead of price count |
| openfoodfacts/robotoff | Replace obsolete facet URLs with the /facets/ prefix |
| VirusTotal/yara | Bound the tilde-stream row count in dotnet_parse_tilde_2 |
| projectdiscovery/nuclei-templates | Detect exposed ZooKeeper even when the 4lw commands are blocked |
| splunk/security_content | Add a computer-account filter to the service-ticket detection |
| flipperdevices/flipperone-docs | Fix broken section anchors and an image path, add a missing eSIM mention |
| flipperdevices/flipperone-docs | Fix a mismatched M.2 thickness spec on the M.2 port page |
| merbanan/rtl_433 | Reject out-of-range temperature and humidity in the GT-WT03 decoder |
| merbanan/rtl_433 | Reject implausible temperature and humidity in the WT450 decoder |
| merbanan/rtl_433 | Reject an all-zero Truck TPMS payload that passes the XOR check |
| flipperdevices/flipperzero-firmware | Reject a zero or negative timer interval in js_event_loop |
| flipperdevices/flipperzero-firmware | Don't read past the buffer in bit_lib when the requested bits fit one byte |
| flipperdevices/flipper-application-catalog | Log the folder being skipped, not a leftover filename |
Open / in review: 65 PRs across 44 repos
Security and detection
- assimp/assimp #6800: out-of-bounds access on short uv source and mapping mode properties
- ffuf/ffuf #924: keyword and value columns scrambled in CSV/HTML/Markdown output when more than one wordlist is used
- YARAHQ/yara-forge #89: match author/reference/description meta keys case-insensitively
- semgrep/semgrep-rules #3999: stop flagging Renovate
packageRulesalready covered byminimumReleaseAge - semgrep/semgrep-rules #3998: remove the obsolete
no-replaceallrule - evilsocket/opensnitch #1634: fix a duplicated
a-zclass in auto-generated rule names - evilsocket/opensnitch #1641: an empty
listoperator matches every connection, so one rule with no sub-operators swallows the whole ruleset - elastic/detection-rules #6501: KQL-to-EQL conversion treats an escaped or quoted asterisk as a wildcard
- elastic/detection-rules #6502: validate the field against the schema in KQL range expressions
- SigmaHQ/sigma #6180: the macOS network-service-scanning filter matches any
l, not netcat's listen flag - semgrep/semgrep-rules #4020:
run-shell-injectionflags the truthiness-check shape on bare inputs - ffuf/ffuf #925: strip wordlist comments before the
%ext%branch, not only after it - YARAHQ/yara-forge #91: a missing comma in the tag_names list glues two tags into one
- projectdiscovery/nuclei-templates #17032: the HP printer default-login template matches on a bare 200, so it flags every HP printer as passwordless
- osquery/osquery #9068: the
mountstable truncates statfs block and inode counts to 32 bits, wrapping any filesystem over 2^32 blocks - splunk/security_content #4245: two LOLBin detections reference a CIM field that doesn't exist, so renaming whoami/arp slips right past them
- jsverse/transloco #982: block prototype pollution in the keys-manager's
mergeDeep
OSINT
- mxrch/GHunt #601: read
isDefaultfrom the API for profile photos instead of hashing the image - mxrch/GHunt #602: key profile photos by their own container, not the outer loop's
RF / SDR
- PentHertz/urh-ng #4: fix CRC data-range detection for reflected (
ref_out) CRCs - UberGuidoZ/Flipper #687: flippercheck, a validator for
.sub/.ir/ RTTTL / playlist files
Flipper One (11 open): the device isn't out yet, so this is kernel, bootloader, MCU firmware, build system and docs
- flipperdevices/flipper-linux-kernel #22: dwc3 returns an error when a gadget dequeues a request that already completed, reshaped so it can go to linux-usb as-is
- flipperdevices/fbtng-corelibs #43: a record-destroy race where a late opener can hang forever
- flipperdevices/fbtng-corelibs #44: an int overflow in the datetime timestamp calculation
- flipperdevices/flipperone-debug-probe #17: the CLI accepts
clock_out 14, which reads past the clock source table - flipperdevices/flipperone-mcu-firmware #220: the USB-C PD controller checks
rx_emptyagainst the wrong register - flipperdevices/flipperone-mcu-firmware #218: the touch controller uses I2C registers before they're initialized
- flipperdevices/flipperone-testing #8, #7 and #6: the test suite passed a failed CPU/GPU stress run, cut the stress test short, and reported a PipeWire restart that never happened
- flipperdevices/flipperos-installer #2 and #1: profile names that collide with reserved subvolumes, and an unreadable
/procsource treated as a free disk
Flipper Zero (5 open): apps, host tooling, and the RPC libraries
- flipperdevices/qFlipper #255: crash when a log message arrives with no category
- flipperdevices/flipperzero-good-faps #308: mfkey redoes recovery for nonces it already solved
- flipperdevices/video-game-module #16: check the screen frame size before copying it
- flipperdevices/video-game-module #17: reject data frames larger than the receive buffer
- flipperdevices/flipperzero-ufbt #68: a build killed by a signal is reported as a success
Accessibility
- ClickHouse/click-ui #1140: respect a consumer-supplied
aria-labelinstead of overwriting it with the icon name - jcsteh/osara #1434: on the Mac, messages that carry a menu access key never find their translations, so localized menus read out in English
Privacy / anti-surveillance
- FoggedLens/deflock #133: tell people they need an OpenStreetMap account before they pick a way to report a camera
- FoggedLens/deflock #137: the geocode cache key ignores the geojson variant, so two different lookups share one cache slot
- ooni/probe-cli #1811: make tlsmiddlebox's ClientId settable and validate its value
- guardianproject/ripple #45: integer division collapses the panic-swipe ripple to zero on odd screen heights
- guardianproject/tor-android #197: NullPointerException in
getPortFromGetInfowhengetInfo()fails - guardianproject/tor-android #198: pin jar timestamps so builds of the same commit come out byte-identical
- guardianproject/proofmode-android #143: the share screen crashes when a shared media URI's read grant has expired
Cryptography and wallets
- cake-tech/cupcake #62: the seed-check quiz can offer the correct word twice among the choices
- monero-project/monero-gui #4685: a self-shadowing
constthrows before the amount field can strip a leading zero, on four wallet pages - openmls/openmls #2203:
clear_proposal_queuebuilt the delete key by hand so it never matched the stored one, leaking every queued proposal body - monero-project/monero #11213: a reserve proof counts outputs already spent by a broadcast-but-unconfirmed send, so it proves reserve the wallet no longer has
Systems / web
- ClickHouse/click-ui #1141: default Button
htmlTypeto button - openclimatefix/graph_weather #231: division-by-zero on single-axis grids
- openclimatefix/graph_weather #230: guard optional data-module imports
- omacom/omarchy #8076: stop the hybrid GPU test failing on a machine without Omarchy installed
- omacom/omarchy #8088: keep the migration list off each migration's stdin
Health / food
- openfoodfacts/robotoff #1919: anchor nutrient-mention regex alternatives on word boundaries
Localization
- TheIllusiveC4/Curios #622 and #621: Turkish placeholder and locale-casing bugs
- drewnoakes/metadata-extractor #741: lowercase hardcoded description strings with
Locale.ROOTso the Turkish locale doesn't corrupt them - chubin/wttr.in #1279 and #1278: RTL mark and corrupted Persian/Hebrew/Arabic captions
- tolgee/tolgee-platform #3789: keep the zero plural form in Apple XLIFF export
- mdn/translated-content #37508: use a real minus sign in the BigInt operator example across the Korean, Portuguese and Russian docs
Directory listings (not fixes, just getting the tools indexed)
- yigitkonur/awesome-webmcp #10 and #9: add webmcp-devtools and webmcp-lint
All of this is free and maintained on my own time. If one of these tools saves you a trip, a bad batch, or an afternoon of debugging, sponsoring is what keeps it that way. Every sponsor gets a permanent line in SUPPORTERS.md.
Munzzyy1@proton.me