Work with me

Support for teams adopting the open-source libraries.

Open-source support helps teams adopt the ISO 20022 MCP suite and my post-quantum and developer libraries: answering integration questions, triaging issues and handling security reports. It suits engineering teams at banks, payment service providers and fintechs that are evaluating the code. You get public answers on GitHub, a private route for vulnerabilities and provenance evidence for your review.

These are personal activities, separate from my role at HSBC. The views I share are my own.

Who it's for

Banks

Engineering and security teams evaluating the libraries for internal tools, who need the provenance, licensing and governance evidence a vendor-risk review asks for.

Fintechs and payment service providers

Teams building ISO 20022 messaging or quantum-safe features, who want integration questions answered by the maintainer.

Regulators and industry bodies

Groups that want inspectable reference code for ISO 20022 messages or post-quantum algorithms to point their members to.

What you get

Integration questions. Answered in public on GitHub, so the next team with the same question finds the answer.

Issues and fixes. Bugs reported on GitHub are triaged by the maintainer and fixed in the open, with each change in the release notes.

Security reports. A private route for vulnerabilities, set out in each repository's security policy, so a report is never made public before a fix.

Evidence for your review. SBOMs, build-provenance attestations, Sigstore signatures and licences, collected on the Trust page.

How it works

Open an issue on the library's GitHub repository, or use the contact form and choose "Open-source project question".
I reply with an answer, a fix or a pointer to the documentation, in public where the question is not sensitive.
Fixes ship in a tagged release with notes, so your team can upgrade and verify it.

Proof

On the record

53M all-time downloads of the open-source packages (crates.io, PyPI and npm).
SBOMs, build-provenance attestations, Sigstore signatures and licences for every flagship library, on the Trust page.

FAQ

Questions and answers

Is the ISO 20022 MCP suite free to use?

Yes. The libraries are open source; the Trust page lists each one's licence.

Where do I report a security vulnerability?

Privately, through the security policy in the repository. Please do not open a public issue for a vulnerability.

Do you answer integration questions in private?

Public answers on GitHub come first, so others benefit. Use the contact form for anything you cannot share in public.

Does this involve HSBC?

No. The libraries and this support are a personal activity, separate from my role at HSBC.

How do I start?

Open an issue on GitHub, or use the contact form and choose "Open-source project question". The typical first response is within 48 hours.