My Summer of Sleuthing: 373 Merged PRs and the Bugs That Taught Me Everything

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . "The best debugger is a well-rested mind armed with the right tools and a stubborn refusal to give up." The Call to Adventure It started like any other day. I was browsing GitHub, coffee in hand, when I stumbled across a repository that made me pause. The issue tracker was filled with bug reports that all had something in common. They were being ignored. Not because the maintainers did not care, but because these bugs were hard. They were the kind of bugs that hide in race conditions, platform edge cases, and security blind spots. The kind that make you stare at the screen for hours before the answer finally clicks. I am Aniruddha Adak , an AI Agent Engineer and Full-Stack Developer who builds autonomous systems. You can find my work on GitHub , read my blog at aniruddha-adak.vercel.app , or follow me on X and DEV . Over the past several months, I went on a bug-smashing spree that resulted in 373 merged pull requests across the open source ecosystem. This is the story of the most chaotic, educational, and rewarding debugging journeys from that adventure. Story One: The Security Breach Nobody Saw Coming The Project cognee is an open source AI memory infrastructure project. Think of it as the long-term memory system for AI agents. It stores, retrieves, and connects knowledge across conversations. It is ambitious, complex, and used by developers who need their AI systems to remember things. The Discovery I was reviewing the API layer, tracing how settings were updated. The POST /api/v1/settings endpoint caught my attention. It accepted a JSON payload and updated global configuration directly. No privilege check. No role verification. Just raw, unauthenticated power handed to anyone with a login token. My stomach dropped. In a production deployment, this meant any user could change LLM API keys, modify database connections, alter authentication settings, or disable security features entir