$ goroot_ Notes from the interface

GitHub Repo Risk Score

Paste a repo, get a first-pass risk score from license, commit activity, contributors and stars — with optional deeper checks for security advisories, bus factor and community health — before you tell a developer yes or no.

Privacy at a glance

Stored in your browser Nothing
External services called api.github.com (GitHub REST API), called directly from your browser.
Requires a credential Optional

A developer wants to pull a GitHub repo into the stack. You need a fast first read before you commit to the real due diligence: does it have a license you can actually use, is anyone still maintaining it, and would the project survive its one maintainer leaving.

What it computes

Enter a GitHub URL or just owner/repo — a link straight from the Issues or Pull Requests tab works too, the extra path gets ignored. The tool calls the GitHub API directly from your browser — nothing goes through my server — and pulls six signals automatically, all free in the same handful of requests:

  • License — whether GitHub detected an OSI-style FOSS license at all. No license means “all rights reserved” by default, whatever the README claims.
  • Last commit on the default branch — recency as a proxy for whether the project is still alive.
  • Contributors — GitHub’s public API has no “maintainer” role, so contributor count is the closest available proxy for bus factor. A repo with one contributor is one resignation away from unmaintained.
  • Stars and forks — weak signals individually, but forks in particular filter out pure bookmarking: forking means someone actually built on the code.
  • Repo age — shown for context, not scored. Old can mean stable or abandoned; young can mean fresh or immature — there’s no clean “good” direction here.

Each scored signal is weighted and combined into a 0–100 score. A missing or non-FOSS license caps the score hard, regardless of how good the other numbers look — a popular, actively maintained repo with no license is still a legal problem, arguably a bigger one because people assume it’s fine.

Optional deeper checks

Four more signals sit behind checkboxes, off by default, because each costs an extra GitHub API call against the 60/hour anonymous budget:

  • Community profile health — GitHub’s own composite score for whether README, LICENSE, CONTRIBUTING and a security policy exist.
  • Public security advisories — published GHSA entries against the repo. A public critical advisory caps the score the same way a missing license does.
  • Bus factor — the top contributor’s share of total commits, pulled from commit stats rather than the raw contributor list. A repo can show “12 contributors” and still be 95% one person; this catches that.
  • Commit trend — commit volume over the last 12 weeks, to tell sustained activity apart from a single commit that revived an otherwise dead repo right before you looked.

Check any of these on and the score folds them in with the rest; leave them off and the core six still give a reasonable read.

What it doesn’t do

It doesn’t read the code, look at the issue tracker, or check whether the license terms fit your use case (GPL vs. a proprietary product is a different conversation than GPL vs. an internal tool). Anonymous GitHub API calls are capped at 60 requests/hour per IP; if you hit that limit, paste a personal access token (no scopes needed for public repos) — it stays in your browser and goes straight to api.github.com.

Treat the score as a filter for the obvious no’s, not a substitute for actually reading the license and skimming the commit history yourself.