I build small, sharp tools under Flight Unreached and contribute to open source where correctness matters: security, RF/SDR, accessibility, health tech.
| Project | What it does |
|---|---|
| unslop | Catches the AI tells in your writing — buzzwords, filler, contrast-frame clichés, flat rhythm — scores them, and points you at what to fix. Four ways to run it: a browser app, a CLI, a CI gate (pre-commit, GitHub Action, reviewdog), and an agent skill that installs into Claude Code, Codex, or Cursor so your coding agent cleans up its own prose before it hands you a PR. Deterministic and dependency-free; nothing you paste leaves your machine. |
| hopandhaul | Finds when flying into a cheaper hub and taking the train beats flying direct. Click-the-map planner, 4,175-airport database, CO2e comparison, UI in 46 languages. |
| liftmath | Strength-training math done properly instead of eyeballed: a six-formula consensus 1RM (barbell or weighted pull-up/dip), %1RM/RIR load charts, volume landmarks, plate loading against the plates you actually own, 5/3/1 / GZCLP / nSuns program templates, and Wilks/DOTS/IPF GL scores. A CLI and a web app that reads in 32 languages. Every number traces back to a named source, not a black box. |
All three are free for noncommercial use, pure standard-library Python with a static web app and no build step, and open to contributors, with good-first-issues waiting.
Thirteen merged now, with another forty-odd open across roughly thirty more repos: correctness, security, accessibility, and translation. A few that were fun to track down: byte-order corruption in RFID dump files, authenticode digest buffers that were never null-terminated in YARA, an OAuth open-redirect in a medical-records system, a flipped GPS hemisphere in a photo-evidence app, and a fixed-size HTTP header buffer that overflowed on emit.
| Repo | Change |
|---|---|
| VirusTotal/yara | Null-terminate authenticode digest/thumbprint hex buffers |
| VirusTotal/yara | Fix a string leak in CLI args_free |
| VirusTotal/yara | Honor -w/--no-warnings for the file-too-large skip message |
| YARAHQ/yara-forge | Align indexed and patterned hash meta fields |
| SigmaHQ/sigma | Add a vmmemWSL exception to the non-existing-file rule |
| splunk/security_content | Add a PreAuthType filter to the PetitPotam Kerberos detection |
| RfidResearchGroup/proxmark3 | Fix byte-swapped, corrupted EM 4x05 dump files |
| merbanan/rtl_433 | Restore a missing bitbuffer_clear in pulse_slicer_dmc |
| merbanan/rtl_433 | Fix swapped order/inversion nibbles in the secplus_v2 docs |
| jcsteh/osara | Make paste/duplicate screen-reader messages translatable |
| guardianproject/orbot-android | Request ACCESS_LOCAL_NETWORK before opening the proxy on all interfaces |
| symfony/symfony | Fix the Finnish BIC/IBAN mismatch translation |
| ghostfolio/ghostfolio | Improve the French localization |
Open / in review — 40+ PRs across ~30 more repos
Security and detection
- elastic/detection-rules #6383: KQL wildcard lexer fails on escaped specials with spaces
- splunk/security_content #4147: computer-account filter in the service-ticket detection
- openemr/openemr #12768: validate
post_logout_redirect_uribefore redirecting (open-redirect) - chimera-nas/libevpl #114: fixed-size HTTP header buffer overflow on emit
RF / SDR
- PentHertz/urh-ng #3: wrong int8 magnitude/demod on ARM (signed
char)
Accessibility
- nvaccess/nvda #20444: clearer error for bare drive letters in Create Portable
- patternfly/patternfly #8481: document listbox/option/aria-selected for select menus
Privacy / anti-censorship
- guardianproject/proofmode-android #136: correct the QR bitmap stride
- guardianproject/proofmode-android #135: correct the C2PA GPS hemisphere
- ooni/probe-cli #1786: remove a stray debug print in the feature-flag cache
Systems / web
- osquery/osquery #8986: scan XDG-base-directory Firefox profiles
- osquery/osquery #8987: add the Windsurf
.devinpath tovscode_extensions - ClickHouse/click-ui #1141: default Button
htmlTypeto button - ClickHouse/click-ui #1140: respect a consumer-supplied
aria-label - openclimatefix/graph_weather #231: division-by-zero on single-axis grids
- openclimatefix/graph_weather #230: guard optional data-module imports
- hotosm/tasking-manager #7287: replace Nominatim reverse geocoding with pg-nearest-city
- symfony/symfony #64815: drop an always-true
method_existscheck
Health / food
- openfoodfacts/robotoff #1909: fix obsolete facet URLs
- openfoodfacts/open-prices #1376: remove an unreachable branch in the barcode fixups
- davidhealey/waistline #961: guard
Meals.initagainst overlapping calls - davidhealey/waistline #960: distinguish rate-limit/network errors from bad USDA keys
- simonoppowa/OpenNutriTracker #513: catch silent 0-byte exports
Localization (Symfony validator placeholder fixes plus a wider i18n wave)
- symfony/symfony: placeholder fixes across Armenian, Arabic, Basque, Turkish, Galician, Azerbaijani, Traditional Chinese, Finnish, and Welsh
- ghostfolio/ghostfolio #7260: Dutch localization
- mdn/translated-content #36835: correct the Japanese
Reflect.deleteProperty()docs - TheIllusiveC4/Curios #622 and #621: Turkish placeholder and locale-casing bugs
- chubin/wttr.in #1279 and #1278: RTL mark and corrupted Persian/Hebrew/Arabic captions
- tolgee/tolgee-platform #3789: keep the zero plural form in Apple XLIFF export
- jsverse/transloco #940: respect currency in
numberFormatOptions - simonoppowa/OpenNutriTracker #515 and #514: Slovak and English i18n keys
GitLab mirrors · Munzzyy5@proton.me