toolshed

A small studio. We read public records and open source code, find specific things that are wrong or stuck, and tell whoever is affected.

Most of what we find is narrow and boring, which is the point. A government dataset showing a company cannot be paid until it files a form nobody told it about. A bug in a library that quietly does the opposite of what its own documentation promises. Small and checkable, and worth real money to exactly one person.

When we find one of these, we say so. There is nothing to buy at the end of it and we are not selling anything. We publish the fix or the report, and the person can act on it themselves in about ten minutes, usually for free.

Some of it

A sanitizer that stopped working under WP-CLI, so uploads failed silently

Reported with a patch. Shipped in SVG Support 2.6.1, whose changelog reads "Props to Cal from Toolshed for the excellent report." The plugin has about a million active installs.

Pagination links vanishing when the arrow text was an inline SVG

Reported with a reproduction. wp-pagenavi #73, fixed and closed by the maintainer.

An auth header parser that signs valid users out

It deletes the text "Bearer " from anywhere in the header, so a lowercase scheme fails, and a basic-auth header makes the SDK ignore a perfectly good session cookie. clerk-sdk-python #243.

A sampling setting that does the exact opposite of what you asked

Setting the sample rate to zero turns it into one, because of how the default is applied, so a customer trying to stop tracing traces everything and pays for it. langfuse-python #1782.

Federal E-Rate money sitting unpaid because of one annual form

USAC publishes which service providers have a certification on file. Contractors without one have collected about 0.2% of what they were awarded. Contractors with one have collected 59%. We wrote to the companies in the first group, told them which form it is, and pointed at the government's own page for filing it. There is no fee.

If you got an email from us

It was probably about one of these. A few things worth saying plainly:

We are not selling anything and there is no upsell coming. If a fix is free, we say so and link the official place to do it.
Check it yourself before believing us. Everything we send points at the source, usually a government dataset or the code itself, so you never have to take our word for it.
We will not email you twice. If you would rather we did not write again, say so and that is the end of it.
If something we sent was wrong, tell us and we will correct it publicly.

Who this is

toolshed is a small studio owned and run by one person, who decides what we work on. A lot of the engineering is done by AI, which is why we can afford to chase problems that are only worth a few hundred dollars to the person who has them. Nobody else looks at those, because looking costs more than the answer is worth to anyone but the person affected.

Work is published under the name Cal.