toolshed

A small studio. We read public records and open source code, find specific things that are wrong or stuck, and tell whoever is affected.

Most of what we find is narrow and boring, which is the point. A government dataset showing a company cannot be paid until it files a form nobody told it about. A bug in a library that quietly does the opposite of what its own documentation promises. Small and checkable, and worth real money to exactly one person.

When we find one of these, we say so. There is nothing to buy at the end of it and we are not selling anything. We publish the fix or the report, and the person can act on it themselves in about ten minutes, usually for free.

Some of it

A sanitizer that stopped working under WP-CLI, so uploads failed silently

Reported with a patch. Shipped in SVG Support 2.6.1, whose changelog reads "Props to Cal from Toolshed for the excellent report." The plugin has about a million active installs.

Pagination links vanishing when the arrow text was an inline SVG

Reported with a reproduction. wp-pagenavi #73, fixed and closed by the maintainer.

An auth header parser that signs valid users out

It deletes the text "Bearer " from anywhere in the header, so a lowercase scheme fails, and a basic-auth header makes the SDK ignore a perfectly good session cookie. clerk-sdk-python #243.

A login URL that quietly ignored the app you told it to use

The PKCE authorization call accepted a client id and then dropped it, so it built the URL for whichever app the client was configured with. Three sibling methods pass the same argument through correctly. workos-python #700, fixed in #701 and merged the same day.

A sampling setting that does the exact opposite of what you asked

Setting the sample rate to zero turns it into one, because of how the default is applied, so a customer trying to stop tracing traces everything and pays for it. Reported with a reproduction and a suggested patch. langfuse-python #1782, fixed in #1784 and shipped the same day.

A privacy setting that silently did nothing, so prompts were captured in full

Setting privacy_mode on the PostHog module never reached the default client, so the AI wrappers went on capturing entire prompts and outputs from customers who had explicitly turned that off. Reported with a reproduction. posthog-python #768, fixed by a maintainer in #793 and merged about a day later.

A client that skipped TLS certificate checks unless you knew to ask

In the Chroma Python client, the async class did not verify TLS certificates by default while the sync class did, so the same credentials over the same connection got different protection depending on which client you picked. chroma #7511. A fix followed in #7517, crediting the report.

An API key being sent to a server that should never see it

In the firecrawl Python SDK, the async client followed a paginated next URL even when it pointed at a different host, and carried the Authorization header along. The sync client already rewrote that URL back to the configured host, so the two clients disagreed about the same request. Reported with the root cause and the exact line where the paths diverge. firecrawl #4139. An outside contributor wrote the fix within hours in #4155, crediting the analysis.

Federal E-Rate money sitting unpaid because of one annual form

USAC publishes which service providers have a certification on file. Contractors without one have collected about 0.2% of what they were awarded. Contractors with one have collected 59%. We wrote to the companies in the first group, told them which form it is, and pointed at the government's own page for filing it. There is no fee.

If you got an email from us

It was probably about one of these. A few things worth saying plainly:

We are not selling anything and there is no upsell coming. If a fix is free, we say so and link the official place to do it.
Check it yourself before believing us. Everything we send points at the source, usually a government dataset or the code itself, so you never have to take our word for it.
We will not email you twice. If you would rather we did not write again, say so and that is the end of it.
If something we sent was wrong, tell us and we will correct it publicly.

Who this is

toolshed is a small studio owned and run by one person, who decides what we work on. A lot of the engineering is done by AI, which is why we can afford to chase problems that are only worth a few hundred dollars to the person who has them. Nobody else looks at those, because looking costs more than the answer is worth to anyone but the person affected.

Work is published under the name Cal.