Madan Kumar@winklemad

winklemad:~$git log --author=winklemad --state=merged

I find and fix real bugs in the code the world runs on.

16
merged pull requests
60+
in review
40+
organizations
6
languages

// merged fixes

org · pr · what changed
-Chat Completions dropped logprobs=True when top_logprobs was set → API returned a 400
+Forward logprobs=True whenever top_logprobs is present, matching the Responses path
-Deserializing a RunState lost token usage → resumed runs silently under-reported usage (billing)
+Restore the serialized usage when rebuilding the run context
-The attention profiler over-counted softmax@V FLOPs for non-square causal masks
+Count the Q@K and A@V components symmetrically
-DeepSpeedInferenceConfig crashed on a legacy boolean MoE value its own back-compat path was meant to accept
+Accept the legacy value instead of asserting on it
-Quantile-flip invariance skipped the autoregressive branch → corrupted forecast bands past horizon 128
+Flip the AR outputs too, matching the reference flax implementation
carapaceproxydiennea/carapaceproxy#614MERGED
-Absolute-form request URIs bypassed a path-anchored ACL deny rule — an auth bypass (CWE-436 / CWE-863)
+Match ACL rules on the normalized forwarded path
-__hash__ on WithJsonSchema / Examples ignored the mode value → distinct schemas collided
+Include mode in the hash
-SyntheticDataKit.chunk_data emitted chunks over the requested max_tokens
+Respect the token limit when splitting
-The seed field was dropped when bridging a SpeechRequest into the OpenAI format
+Carry seed through the conversion
-Hydrating a store merged incoming reactive Set / Map state into the existing value instead of replacing it → stale entries survived
+Replace the reactive Set / Map on hydration
-compress_schema mutated the caller's schema object in place → side effects on the passed-in data
+Copy before modifying, leaving the caller's schema untouched
uutils · Rustuutils/coreutils#13439MERGED
-paste -s -d didn't restart the delimiter cycle per file → output diverged from GNU coreutils
+Reset the delimiter list at the start of each file
htop · Chtop-dev/htop#2046MERGED
-A reset-on-fork scheduling flag was &=-ed instead of |=-ed → the policy was zeroed on every set
+OR the SCHED_RESET_ON_FORK bit into the policy
psycopg · Pythonpsycopg/psycopg#1373MERGED
-Two DataError messages were missing the f prefix → {...} placeholders printed as literal braces
+Add the f-string prefix so the offending values interpolate
-The digest name filter rendered "and 0 others" when maxNames already covered every item
+Omit the suffix when no names remain
jq · Cjqlang/jq#3586MERGED
-A zero-width global regex match advanced one code unit, not the whole Unicode codepoint — ["🚀" | match(""; "g")] | length miscounted multi-byte chars
+Advance past the full codepoint after a zero-width match

// currently in review

60+ open
NVIDIA Apple Anthropic Google DeepMind Hugging Face Redis Qdrant Spotify Supabase scikit-learn vLLM IBM MLflow Microsoft OpenSearch Scrapy Keras Ollama Dask see all →

// shipped solo

product · < 90 days
PhantomAI multichannel LLM gateway SHIPPED

One workspace and a REST API that route across 9 model providers — OpenAI, Anthropic, Google, Mistral, DeepSeek, xAI, Azure, OpenRouter, and Ollama — with streaming responses, isolated per-user API keys, and a Stripe-metered, per-model credit-billing system. Built end to end, solo, in under 90 days.

Frontend
React 18 · Vite · TypeScript · shadcn-ui / Tailwind · Next.js
Backend
Supabase (Postgres · row-level security · Edge Functions) · Stripe · Vercel

// how i work

Languages
Python · TypeScript / JavaScript · Rust · Go · Java
Domains
AI / ML infrastructure · LLM & agent tooling · databases · backend APIs · data engineering · systems · application security
Method
Read the source → reproduce red → fix the whole bug class → prove it with a test → ship.

Get in touch.

Always happy to talk shop about debugging, systems, and open source.