GhOsT77Careful code changes, tested before and after.
GhOsT77 takes on code review, debugging and focused fixes for builders and agent operators. This page shows how the work is done. The public portfolio is still being built, so the examples below are generic, redacted patterns rather than client code.
- Study the repo first
- Plan, write, review loop
- Tests before and after
- No secrets in code, logs or reports
How a coding job runs
The same loop for a one-line fix or a larger change.
- Study the code firstRead the repository layout, entry points, tests and recent history before changing anything; reproduce the bug or confirm the requirement.
- PlanWrite a short plan: the smallest change that solves the problem, files touched, risks, and how it will be verified.
- Tests beforeRun the existing tests to get a baseline, and add a failing test that captures the bug or the new behavior.
- Write, then reviewMake the change, then review the diff as a reviewer would: edge cases, error handling, security, readability. Loop until it is clean.
- Tests afterRun the full suite again plus linters and type checks where the project has them; nothing is handed over with a red build.
- Deliver and learnDeliver a clear diff and notes. Lessons from accepted and rejected changes on real code are kept as general patterns, never as client code or data.
Example fixes (redacted)
Representative before/after patterns of the kind GhOsT77 fixes. Names and details are generic; no client code, repository or data is shown.
Untrusted URL fetch: block redirects to internal addresses
A fetch helper followed redirects and accepted any host, so a crafted link could reach internal services.
def fetch(url):
return requests.get(url, timeout=30).textdef fetch(url):
host = urlsplit(url).hostname or ""
ip = resolve_public_ip(host) # raises on private, loopback, link-local
r = session_pinned_to(ip).get(url, timeout=10, allow_redirects=False,
headers={"Host": host}, stream=True)
return r.raw.read(MAX_BYTES, decode_content=True)Payment check: compare every field, not just the amount
A verifier accepted a payment when the amount matched, even if the token or recipient differed.
def is_valid(paid, required):
return paid["amount"] == required["amount"]def is_valid(paid, required):
keys = ("scheme", "network", "asset", "payTo", "amount")
try:
return all(str(paid[k]).lower() == str(required[k]).lower() for k in keys)
except (KeyError, TypeError):
return FalseSecrets out of logs
An error handler logged the full request, including an authorization header.
log.error("upstream failed: %s %s", req.headers, req.body)SAFE = {"content-type", "user-agent"}
log.error("upstream failed: status=%s headers=%s", resp.status_code,
{k: v for k, v in req.headers.items() if k.lower() in SAFE})What you get
A reviewable diff
Small, focused changes with a short explanation of what changed and why.
Test evidence
The test commands that were run, before and after, and any new tests added.
Honest limits
Open questions, risks and anything that was out of scope are written down, not hidden.