Dawnmend
Dawnmend

Hall of Fame

We’ve raised 446 pull requests to 70 open-source projects.

Start with one pull requestSee all 446See all 446

One bug, start to finish.

Screenshots were saved where any user on the machine could read them.

reticlehq/reticle#245 1,272 stars +390 −37

packages/tauri/src/capture.rs+156 −18 lines in this file
Code change in packages/tauri/src/capture.rs
removed line 55Removed: let dir = std::env::temp_dir();
removed line 56Removed: let path = dir.join(format!("{}{}.png", capture_prefix(), nanos()));
removed line 57Removed: std::fs::write(&path, png).map_err(|error| error.to_string())?;
removed line 58Removed: sweep_stale_captures(&dir, &path);
added line 55Added: let dir = captures_dir()?;
added line 56Added: let path = dir.join(format!("{}{}.png", CAPTURE_FILE_PREFIX, nanos()));
added line 57Added: write_new_file(&path, &png).map_err(|error| error.to_string())?;
added line 58Added: sweep_stale_captures(dir, &path);
What the marks mean
  • The shared system temp folder: any local user can list it.
  • A private directory created for this process only.

7 of 7 passing

1 of 446

446 pull requests, one dot each.

Pull requests raised per month
MonthPull requests raised
June 202638
July 202660
August 202613
September 2026243
October 202692

The same bugs, project after project.

  1. Which pages skip sign-in. Was: Any address that merely started with /sign-in counted as public. Now: Public means the exact route, or a page under it. Simplified from ParadevAI/Paradev#5466.

    Checks that let the wrong thing through

    Checks that let the wrong thing through

    A guard existed, ran, and compared the wrong value.

    ParadevAI/Paradev#5466 TypeScript 15.5K stars 5 files +82 −17

    apps/web/src/proxy.ts+2 −16 lines in this file
    Code change in apps/web/src/proxy.ts, part 1 of 2
    removed line 14Removed: function isPublicRoute(pathname: string): boolean {
    removed line 15Removed: return publicRoutes.some((route) => pathname.startsWith(route));
    removed line 16Removed: }
    apps/web/src/proxy-routes.ts+22 −0 lines in this file
    Code change in apps/web/src/proxy-routes.ts, part 2 of 2
    added line 12Added: function matchesRouteOrChild(pathname: string, route: string): boolean {
    added line 13Added: return pathname === route || pathname.startsWith(`${route}/`);
    added line 14Added: }
    What the marks mean
    • Anything that merely starts with /sign-in counted as public.
    • Public now means the exact route or a page under it.

    Addresses that only started like a public page, such as /sign-internal next to /sign-in, skipped the sign-in check.

    1. Reproduce

      Found by reading the code; no one had reported it.

    2. Fix

      A page counts as public only if it is exactly that page, or a page under it.

    3. Prove

      On the old code, 10 lookalike addresses got through. With the fix, all 29 checks pass.

    What stays: proxy-routes.test.ts: public paths stay public, sibling paths stay protected.

    View on GitHubFiles changed

    Also raised in this pattern

    • onecli/onecli#561fix(api): canonicalize configured origins in the trusted set3,591 GitHub starsView on GitHub
    • chunkhound/chunkhound#410fix(paths): reject parent escapes in logical lookup fallback1,455 GitHub starsView on GitHub
  2. Average pooling, uneven padding. Was: Padding was counted as values, so edge averages came out too small: 2.5, not 5. Now: Each window divides by how many real values it holds. Simplified from tracel-ai/burn#5592.

    Zero, empty and uneven inputs

    Zero, empty and uneven inputs

    Code that works on the usual case quietly breaks on 0, "", or a lopsided edge.

    tracel-ai/burn#5592 Rust 16.1K stars 2 files +223 −4 AI use stated in the pull request

    crates/burn-nn/src/modules/pool/avg_pool1d.rs+116 −2 lines in this file
    Code change in crates/burn-nn/src/modules/pool/avg_pool1d.rs
    added line 135Added: if let Some(valid) = valid {
    3 lines not shown
    added line 139Added: let valid = avg_pool1d(
    6 lines not shown
    added line 146Added: );
    added line 147Added: let empty = valid.clone().equal_elem(0.0);
    added line 148Added: output / valid.mask_fill(empty, 1.0)
    What the marks mean
    • Divide by how much of each window was real input, so padding no longer drags the average down.

    With uneven padding, averaged values at the edges came out too small: 2.5 instead of 5 in the test.

    1. Reproduce

      A maintainer reported it; we reproduced it with a test that failed on the old code.

    2. Fix

      Count only the real values in each window, not the padding.

    3. Prove

      The new tests failed before the change and pass after it.

    What stays: Tests for AvgPool1d and AvgPool2d with uneven padding.

    View on GitHubFiles changedIssue #5450

    mcp-use/mcp-use#1821 TypeScript 10.8K stars 3 files +31 −1

    libraries/…/src/server/openapi/request.ts+2 −1 lines in this file
    Code change in libraries/typescript/packages/mcp-use/src/server/openapi/request.ts
    removed line 44Removed: return objectResponse(await response.json());
    added line 44Added: const responseText = await response.text();
    added line 45Added: return objectResponse(responseText ? JSON.parse(responseText) : {});
    What the marks mean
    • The new test failed here on the old code: an empty reply isn't JSON.
    • Read the reply as text first, and treat an empty reply as {}.

    When a service replied “done” with nothing else, the AI agent's tool failed with an error instead of carrying on.

    How we found, fixed and proved it

    1. Reproduce

      We filed the issue and reproduced it end to end, with no API key.

    2. Fix

      Read the reply as text first, and treat an empty reply as {}.

    3. Prove

      Failed on the old code, passed with the fix: 8 of 8 in the test file.

    4. Keep

      Added the regression test “handles empty JSON success responses”.

    View on GitHubFiles changedIssue #1816

    Also raised in this pattern

    • PrunaAI/pruna#747fix(data): honor an explicit zero sample size1,328 GitHub starsView on GitHub
  3. Secret settings, in the browser. Was: A failed secret save logged the request to the console, value included. Now: No console output, and no raw errors carrying secret details. Simplified from TracecatHQ/tracecat#2979.

    Private data in shared places

    Private data in shared places

    Secrets and screenshots ending up where other people or logs can read them.

    reticlehq/reticle#245Back to it

    Also raised in this pattern

    • TracecatHQ/tracecat#2979fix(ui): avoid logging secret payloads3,867 GitHub starsView on GitHub
    • ShawnPana/phone-harness#100fix: exclude submitted content from usage telemetry3,950 GitHub starsView on GitHub
  4. Cache writes. Was: A failed overwrite could leave half a value behind, served as a cache hit. Now: New values are written aside, then swapped in whole with os.replace. Simplified from tensorlakeai/tensorlake#977.

    Two things at once

    Two things at once

    Concurrent writes and restarts that lose or corrupt data.

    Also raised in this pattern

    • tensorlakeai/tensorlake#977fix(cache): publish complete values with atomic replacement1,027 GitHub starsView on GitHub
    • OpenDCAI/DataMind#13fix: serialize graph persistence and preserve dirty state for mutations occurring during a save455 GitHub starsView on GitHub
    • TracecatHQ/tracecat#2971fix(attachments): serialize per-case quota checks3,867 GitHub starsView on GitHub

“The diagnosis is right and it’s the part most people get wrong.”

Maintainer, reticlehq/reticle

Dawnmend is built to run this loop on your code.

Overnight. Nothing changes until your team says yes.

No newsletter. We’ll write when it’s your turn.

See how it works

Every project, every pull request.

Request early access

Dawnmend is in development. Leave your work email and we’ll bring your team in as early access opens.

Your email will be used for early-access updates.