I build payment infrastructure on Stellar / Soroban: x402 and MPP payment rails, service discovery, and non-custodial treasury automation.

Most of my public work is either a protocol implementation I maintain or a bug I found in something I depend on and then sent a patch for. Everything below links to the actual issue, PR, or running service — no claim here that you can't click and check yourself.

Both cards are rendered live from the GitHub API by github-stats-extended, so the numbers move on their own rather than being typed in here. Some caveats worth stating, since several of these figures look like they disagree and don't:

• The counts above include my own repositories. The upstream table further down counts only repositories I don't own, so its numbers are smaller by design.
• Commits and contributions are different metrics. The card's Total Commits (last year) counts public commits only. The number on my GitHub profile page is the contribution total, which adds pull requests, issues and reviews on top of commits — and private-repo activity too, which GitHub lets you surface as a count without exposing the repositories. A much larger number there is the two metrics measuring different things, not an error in either.
• Contributed to (last year) on the card is a twelve-month count over every contribution type. The "19 repositories" in the upstream table is all-time and counts only repositories where I opened a PR or an issue. Different window, different definition.
• Language shares are measured across my non-forked repositories, not across every commit I've pushed somewhere else.

I use these libraries in production, so when one breaks I try to arrive with the diff rather than just the complaint. Snapshot below is accurate as of 2026-08-29; the live queries at the bottom always supersede it.

• eas-sdk#132 — getUIDsFromAttestReceipt trusted log topic0 without checking the emitter address, so a malicious resolver could inject spoofed UIDs in multiAttest(). Closed as completed.
• x402#3171 — paymentRequirementsMatchAccepted threw on a missing/null payload.accepted, leaking a raw internal error to the resource server. I found and reported it; the code fix was written by @JasonColapietro in #3180 ("Fixes #3171"), merged 2026-08-17. The merged patch is his work, not mine — my part was the report.
• x402#3270 — HTTPFacilitatorClient.settle()/verify() decoded the EXTENSION-RESPONSES header and then discarded it, so resource servers couldn't branch on extension outcomes. Picked up by another contributor as #3278 ("Fixes #3270"), currently open.

Reported and awaiting maintainer response:

• x402-foundation/x402 — #3121 (broken canonical URL for mcp://tool/{toolName}), #3148 (payment-error advertised in CORS, never emitted), #3169 (double percent-encoding bypasses isValidRouteTemplate's traversal and scheme-injection checks)
• stellar/js-stellar-sdk — #1681, #1683 (auth-entry signing against the wrong public key)
• OpenZeppelin/stellar-contracts — #839 (__check_auth traps on a Signer::Delegated + CallContract auth entry)
• stellar/stellar-mpp-sdk — #58 (allow an external SEP-43 signer instead of a raw secret key)
• Creit-Tech/Stellar-Wallets-Kit — #105 (signMessage() JSDoc says SEP-43 hex, Freighter returns base64)
• foundry-rs/foundry — #16209 (cast wallet new <name> still fails with a bare account name)

Totals as of 2026-08-29 — 18 pull requests and 29 issues opened across 19 repositories I don't own, belonging to 16 different accounts; 5 PRs merged. Not every one landed, and the closed-unmerged ones are in the same search: all my PRs · all my issues

Protocols — x402, MPP (Charge and Channel), SEP-41 / SAC, SEP-43, SEP-53, CAP-71 delegated auth, MCP Chains — Stellar / Soroban primarily; some EVM and Solana work

• Small PRs, one root cause each, with the reproduction in the description.
• If I file a bug in a dependency, I try to open the fix alongside it — #3187 → #3228, #1655 → #1672, #840 → #844.
• When I'm not sure whether it's my bug or theirs, I say so in the issue rather than asserting a diagnosis I can't back (#839 is an example).
• Every contract I ship is non-custodial by construction: the client signs, the protocol never holds a key that can move funds.

Open an issue on any repo above, or start with periplo.xyz · nirium.xyz · contextio.xyz