Every contribution below is a merged pull request authored by @arpitjain099 on a public repo. The bulk of recent work has been least-privilege CI hardening — quiet, mechanical, cross-cutting security fixes that ship to every downstream consumer the moment they're merged. Mixed in are substantive code, documentation, and security-disclosure contributions to the orgs people recognise.
After Codecov (2021) and SolarWinds (2020), unrestricted GitHub Actions token scope became a known supply-chain attack vector — a compromised dependency can exfiltrate secrets or push malicious commits whenever the workflow's GITHUB_TOKEN has unscoped write access. I built a scanner that finds public workflows missing explicit permissions: declarations and ship hardening PRs to the orgs I depend on most. The recurring pattern below — "declare contents: read on N workflows" — is the same systematic supply-chain work applied across hundreds of repos.
The foundation behind Kafka, Airflow, Tomcat, Beam, Doris, Superset, Arrow, Camel, Hudi and a long tail of infrastructure projects that power the modern data and web stack. CI security hardening (least-privilege workflow permissions) plus correctness fixes across docs and code.
The de-facto linter for the JavaScript ecosystem. Merged PRs across the core (js), the website, the JSON / CSS / markdown plugins, eslintrc, the config-inspector, the rewrite repo, rfcs, the GitHub bot and more — least-privilege workflow permissions plus a command-injection fix in the TSC meeting transcript workflow.
The cluster of foundations and projects that make up cloud-native production: the OCI runtime (containerd), the original container engine (Docker / Moby), the CNCF org itself, and Grafana dashboards. Workflow permission hardening across all of them.
Across the Google and GoogleCloudPlatform GitHub organisations: Perfetto (Android-wide tracing), gVisor (sandbox runtime), OSV-Scalibr (vulnerability scanning), oss-fuzz, oss-rebuild, Crubit (C++/Rust interop), Google Fonts, Ground Android, Android Cuttlefish, plus the GCP foundation modules and gcsfuse.
The columnar OLAP database that powers a huge slice of modern analytics workloads. CI workflow permission hardening across docs, the C++ client, the .NET / EF Core integration, the official Terraform provider, Spark connector, Rust client, Postgres FDW, build tools, and the LibreChat admin panel.
The combined Microsoft estate on GitHub. Highlights: a substantive PR to Azure/azure-quickstart-templates that reverse-engineered an undocumented endpoint to add Azure Monitor observability; WSL workflow hardening; multiple documentation corrections at MicrosoftDocs/azure-docs; CI hardening across Aspire, FLAML, copilot-for-eclipse, Bicep, and the Azure TypeSpec project.
The container orchestrator that runs most of cloud-native production, plus its sister sigs organisation that holds cluster-api, controller-runtime, CSI drivers, AWS load balancer controller, and conformance tooling. One upstream Kubernetes fix repaired a silent build-system regex; the rest are CI security hardening across the SIG repos.
One major JavaScript framework; merged contributions across the whole ecosystem — core, Pinia (state), Router, Test Utils, Create-Vue, the ESLint TypeScript config, Devtools, vue-eslint-parser, Language Tools, and the new JSX-Vapor. Includes a fix to prevent script injection in the Language Tools auto-version workflow.
The Julia programming language and its core standard-library packages — widely used in scientific computing and high-performance numerics. Workflow permission hardening and cleanup across Pkg.jl, Downloads.jl, BumpStdlibs.jl, JuliaC.jl, Compat.jl, the version manager, the language website, LinearAlgebra.jl, and JuliaSyntaxHighlighting.jl.
The de-facto open-source monitoring & alerting stack — runs in basically every modern observability pipeline. Workflow hardening across client_golang, alertmanager, pushgateway, jmx_exporter, statsd_exporter, promu, test-infra, compliance and proposals.
The U.S. federal agency that authors the SSDF, OSCAL, CSF and the rest of the canon downstream cybersecurity guidance is built on. Improvements to OSCAL (the compliance-as-code framework) including resource-fragment link uniqueness, merge-test selectors, and documentation corrections; the macOS security baseline tooling; the FiPy scientific solver; and the CRAFT repository.
The Cybersecurity & Infrastructure Security Agency — the U.S. federal agency that operates the .gov top-level domain and leads national cyber defence. Substantive security fixes across Admiral (ReDoS and shell-injection hardening), pshtt (port-aware HTTPS checks), ScubaGear (PowerShell documentation), ScubaGoggles, cyhy-reports, manage.get.gov, and Actions SHA-pinning in network-architecture-verification.
The document-oriented database used at the largest scale across the modern web. Merged contributions across the OpenAPI repo, Atlas CLI, IPA, and winkerberos — capping GITHUB_TOKEN scope across changelog, semantic-commit, IPA, version-reminder, report, and build workflows.
The Open Worldwide Application Security Project — the foundation behind the OWASP Top 10 and the broader app-security canon. CI hardening across DockSec, the GitHub Workflow Updater Extension, wrongsecrets-binaries, AISVS, cve-lite-cli, OpenCRE, and SecurityShepherd.
The InfluxDB time-series database ecosystem. CI hardening across telegraf (the agent), chronograf (the UI), Helm charts, Flux, the docs, DataFusion UDF WASM, and validate-semantic-github-messages.
The Ruby on Rails web framework and its ecosystem packages. CI workflow permission hardening across the session store, ActiveResource, Bootsnap, devcontainer, ExecJS, Sprockets, and Thor.
The in-memory data store and its official client libraries. CI workflow hardening across NRedisStack (.NET), Jedis (Java), Lettuce (async Java), redis-py (Python), and memtier_benchmark (performance testing).
The Ruby programming language and its core infrastructure. CI hardening across rbs (type signatures), Actions, debug, docker-images, RubyGems, and the Ruby website.
Meta's AI research GitHub organisation. CI hardening across spdl (synthetic data pipelines), Hydra, exca, prompt-siren, ProgramBench and SustainableConcrete.
The modern HTTP reverse proxy and edge router used in cloud-native and container environments. CI workflow hardening across the main traefik repo, the Helm chart, Faency, assimilis, Hub CRDs, and the ingress-nginx migration tool.
The Elasticsearch + observability stack. CI hardening across the Node.js APM agent, docs-actions, docs-builder, ECS (the schema), and the elastic-agent itself.
The AWS GitHub organisation hosts both the official SDKs and many of the security primitives the broader cloud ecosystem depends on. CI hardening across aws-lc, aws-sam-cli, sagemaker-distribution, Lambda Web Adapter, and Code Editor.
The software supply chain signing and transparency project (cosign, Rekor, Fulcio). Substantive code fixes: non-ASCII identity CSR generation in sigstore-python, whitespace-tolerant base64 in sigstore-rs, plus CI hardening across k8s-manifest-sigstore and sigstore-java.
The reactive web framework. CI hardening across the ESLint plugin, the Svelte ESLint parser, and acorn-typescript.
Workflow permission hardening across Adobe's Spectrum design-system repos (react-spectrum, spectrum-design-data), da-live, and k8s-shredder.
Airbnb's open-source iOS and Swift ecosystem. CI workflow hardening across HorizonCalendar, Lottie for iOS, Lottie SPM, and MagazineLayout.
Aqua maintains Trivy, the de-facto open-source vulnerability scanner for containers, IaC, and code. Contributions include a data-race fix in Trivy's Terraform remote module resolver, CI hardening on trivy-db, plus documentation and YAML misconfiguration fixes in trivy-checks.
The Node.js JavaScript runtime and its core tooling. CI hardening across gyp-next, amaro, and the Technical Steering Committee repo.
NVIDIA's GitHub organisation — the hardware org that runs the modern AI stack. CI hardening across TransformerEngine, CUDA Quantum Extensions, gpu-driver-container, and the cuDF Spark integration.
The default deep-learning framework powering most modern ML research and a substantial portion of production inference. Workflow security hardening across helion, torchtitan, tensordict and the devlogs site.
Block (Square)'s GitHub organisation. CI hardening on Blueprint (Swift), okhttp (the dominant Java HTTP client), Wire (gRPC for Kotlin/Swift), and workflow-kotlin.
The payments infrastructure platform. CI workflow hardening across the OpenAPI spec repo, connect-js, link-cli, and react-connect-js.
CI hardening on Uber's causal-inference ML library, the Swift mock generator, geojson2h3, and RIBs for iOS.
The frontend cloud platform behind Next.js. CI workflow hardening across the storage SDK, styled-jsx, and the v0 SDK.
Cloudflare's GitHub organisation — the edge network that handles a meaningful slice of all internet traffic.
CI hardening on the distributed SQL database org — django-cockroachdb, Helm charts, and the Pebble storage engine.
CI hardening and cleanup across Microsoft .NET org repos — Nerdbank.Streams, .NET MAUI, and .NET for Android.
The Kubernetes security platform. Substantive code fixes: HTTP timeout on the scan listener server, index-out-of-range panic fix for image names, and security-severity SARIF enrichment for Code Scanning.
The Linux Foundation's GitHub repos. CI hardening across crowd.dev, EasyCLA, and LFX Self-Serve.
The opinionated code formatter. CI hardening across prettier-cli, eslint-plugin-prettier, and prettier-emacs.
The Python language organisation. CI hardening across the CPython devguide, and the Hungarian and Japanese documentation translations.
The Rust programming language organisation. CI hardening across the language reference, Miri (the interpreter/undefined-behaviour detector), and rustfmt (the formatter).
NASA's flight-software framework (used on actual spacecraft), USA.gov's public services portal, GSA's Federal Website Index, Code for America's VITA-Min tax service, NOAA's PyNUCOS unit conversion library, the DoD Cyber Crime Center, and City of Bloomington's uReport. Documentation, security fixes, and substantive code contributions shipped into codebases that quietly power U.S. government operations.
One- and two-PR contributions across orgs people recognise: OpenAI, Apple, HuggingFace, Datadog, Shopify, Deno, Bun, CockroachDB, LLVM, NumPy, SciPy, pandas, Nuxt, Vite, Prettier, JetBrains, Rapid7 (Metasploit), Splunk OCSF, Sandia National Labs, Cilium, Envoy, SPIFFE and more. Every entry below is a real merged pull request — click through to read the diff.
The original work — tools I started because the gap was annoying me, not because anyone asked. A few are slowly finding users; one is the seed of the larger toolkit I’m building now.
Acknowledged for responsible-disclosure security reports across these projects.