A public record of security contributions by SashaMIT (Elacity) that have been reviewed and merged into upstream projects' codebases.
Each entry links to the merged pull request and resulting commit. Only work accepted upstream is listed.
| Date | Upstream | What changed | Proof |
|---|---|---|---|
| 2026-08-06 | solana-program/token | Bind publish workflow package-path input via env before shell use (CI hardening) | PR #168 (merged) · commit dbd8943 |
| 2026-08-06 | solana-program/compute-budget | Bind publish workflow package-path input via env before shell use (CI hardening) | PR #37 (merged) · commit 1f3c265 |
| 2026-08-06 | solana-program/system | Bind publish workflow package-path input via env before shell use (CI hardening) | PR #89 (merged) · commit 8c47b48 |
| 2026-08-06 | solana-program/address-lookup-table | Bind publish workflow package-path input via env before shell use (CI hardening) | PR #346 (merged) · commit f8b3abf |
| 2026-08-06 | solana-program/record | Bind publish workflow package-path input via env before shell use (CI hardening) | PR #363 (merged) · commit 9827005 |
| 2026-08-06 | solana-program/token-2022 | Bind publish workflow package-path input via env before shell use (CI hardening) | PR #1365 (merged) · commit d06c18b |
| 2026-08-06 | solana-program/token-metadata | Bind publish workflow package-path input via env before shell use (CI hardening) | PR #111 (merged) · commit 1db90f1 |
| 2026-08-06 | solana-program/stake-pool | Bind publish workflow package-path input via env before shell use (CI hardening) | PR #846 (merged) · commit 9e2dd0f |
| 2026-08-06 | solana-program/zk-elgamal-proof | Bind publish workflow package-path input via env before shell use (CI hardening) | PR #505 (merged) · commit 5c86710 |
| 2026-08-06 | solana-program/token-group | Bind publish workflow package-path input via env before shell use (CI hardening) | PR #117 (merged) · commit 52def57 |
| 2026-08-06 | solana-program/feature-gate | Bind publish workflow package-path input via env before shell use (CI hardening) | PR #83 (merged) · commit 2875e8d |
| 2026-08-06 | solana-program/associated-token-account | Bind publish workflow package-path input via env before shell use (CI hardening) | PR #293 (merged) · commit 5ef2d95 |
| 2026-08-06 | anza-xyz/agave | Bind version-bump workflow input via env before shell use (script-injection class) | PR #14336 (merged) · commit cddb780 |
| 2026-08-05 | hyperlane-xyz/hyperlane-monorepo | Harden composite action inputs before shell use (script-injection class) | PR #9196 (merged) · commit f1b47af |
| 2026-08-04 | x402-foundation/x402 | Plumb spend policies through MCP client factory so policy checks are not bypassed | PR #3034 (merged) · commit 08e84ab |
| 2026-08-04 | x402-foundation/x402 | Verify ERC-20 Transfer event after exact/eip3009 settlement (no silent false success) | PR #3032 (merged) · commit 3c63262 |
| 2026-08-04 | x402-foundation/x402 | Stop silent second charges on MCP corrective-402 recovery payments | PR #3033 (merged) · commit c427425 |