Juan explains how the bug was found through a security audit, why it went unnoticed in production for years, and how the G-Research team handled responsible disclosure — being transparent about the flaw even when it wasn't the easiest choice from a marketing standpoint.

The conversation also covers how GitProxy works as a network-level proxy for Git requests, unpacking and validating Git pack files, auditing pushes, and blocking data exfiltration before code reaches remotes like GitHub or GitLab. Juan and Jay discuss a new single-push approval workflow in development, and where artificial intelligence (AI) tools help — and where they still fall short — in software architecture and system design.

Juan also shares his path from Major League Hacking (MLH) Fellow to full-time GitProxy maintainer in under two years, the mindset shift required to go from writing code to being responsible for reviewing other people's code, working through imposter syndrome as a new maintainer, and practical advice for engineers applying to the MLH Fellowship — including why a well-lit, professional video call setup matters more than people expect.

GitProxy - https://git-proxy.finos.org/
Open WebUI - https://openwebui.com/
MLH Fellowship - https://fellowship.mlh.com/
"Developers" - https://www.youtube.com/watch?v=8fcSviC7cRM

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/zNUTa4s0l3k.

The GR-OSS OUT Podcast is produced by Ben Wiley.

Special Guest: Juan Escalada.

CID also share his journey from ALX (African Leadership X), the MLH Fellowship to full-time open source maintainer of OpenStack Ironic and how it changed his life.

The conversation covers:

• What OpenStack Ironic is and the problem it solves for bare metal provisioning
• Runbooks, a feature for predefining and scoping automation steps across servers, and the upcoming Version 2 (V2) improvements
• Why this release cycle has focused heavily on security advisories and vulnerability backports across four stable release branches
• CID's path from the Major League Hacking (MLH) Fellowship and the African Leadership Experience (ALX) software engineering program to becoming a full-time open source maintainer
• The realities of open source code review, the anxiety of working in public, and why backward compatibility is one of the most overlooked but critical skills in maintaining large infrastructure projects
• CID's advice for anyone facing rejection from a fellowship or open source community

Links
CID's Blog - https://auditorical.com/
OpenStack Ironic - https://opendev.org/openstack/ironic
MLH Fellowship - https://fellowship.mlh.com/
ALX - https://www.alxafrica.com/
Eventlet - https://evenlet.net/
Runbooks - https://docs.openstack.org/ironic/latest/admin/runbooks.html

G-Research is hiring in Dallas, TX and London, UK! Apply at https://gresearch.com/vacancies.

For a video version of this podcast, check out https://youtu.be/fbsI8l-MaFA.

The GR-OSS OUT Podcast is produced by Ben Wiley.

Special Guest: CID.