CoreFoundry

Independent research and engineering for open-source infrastructure.

I investigate performance bottlenecks, correctness bugs, and security issues—and turn validated findings into upstream contributions. The goal is straightforward: improve software that other systems depend on.

🔬 Research & Upstream Engineering

⚡ Performance · 🛠️ Correctness · 🔐 Security

Research Area	Selected Projects	Upstream Evidence
🌐 Networking & Web	curl, urllib3, NGINX, Rack, reqwest	urllib3: 19–23% less CPU
🔐 Security & Cryptography	AWS-LC, curl, CERN ROOT	curl: CVE-2026-115529; CERN ROOT: merged RNTuple safety fix (credited report)
☁️ Cloud & Containers	Apple Container	Apple Container: State recovery
🔬 Scientific Computing	NumPy, SciPy, CERN ROOT	NumPy: Fixed undefined shifts
🖥️ HPC & Parallel Computing	MPICH, Kokkos	Kokkos: Fixed tile-size overflow; MPICH: Resource cleanup
🏢 Enterprise Infrastructure	Bloomberg BDE, BlazingMQ, Memray	Memray: Up to 28% faster; Bloomberg BDE: 14–73% lower latency
💹 Financial Infrastructure	QuickFIX/J, QuantLib, FINOS	QuickFIX/J: Fixed false write success
🚀 Aerospace & Flight Systems	NASA F´, PX4	PX4: Fixed mission timeout
🗜️ Compression & Data	Blosc2, LZ4, pandas	Blosc2: 35.86 → 2.02 μs; LZ4: Original fix adopted upstream (credited); pandas: 17–25% faster conversion
🐍 Python Ecosystem	packaging, attrs, dateutil, cffi	packaging: Reduced parsing overhead; attrs: Faster attribute access
🎥 Computer Vision & Media	OpenCV	OpenCV: macOS BGRA fast path
⚙️ Systems & Runtime	Apple Container, cffi	Apple Container: Runtime-state safety

Performance figures are from targeted benchmarks. See linked upstream records for review and integration status.

Complete contribution record · Security research

💚 Support Independent Upstream Engineering

Better open-source infrastructure benefits everyone building on it.

CoreFoundry independently investigates performance, correctness, and security issues in widely used software, with findings and improvements contributed upstream.

Initial funding goal: USD 100/month — to cover baseline AI-assisted research and engineering tools.

Corporate sponsorships and institutional research collaborations are welcome.

Funding supports independent, public-interest engineering. It does not purchase roadmap control, priority fixes, or guaranteed outcomes.

Become a Sponsor · Funding Principles

📚 Further Reading

Research archive · Contribution ledger · Security research

Research areas · Roadmap · Current work · Publishing process

---

Johnny Kao · GitHub · GitHub Sponsors