GitHub Repo Risk Score
Paste a repo, get a first-pass risk score from license, commit activity, contributors and stars — with optional deeper checks for security advisories, bus factor and community health — before you tell a developer yes or no.
Privacy at a glance
A developer wants to pull a GitHub repo into the stack. You need a fast first read before you commit to the real due diligence: does it have a license you can actually use, is anyone still maintaining it, and would the project survive its one maintainer leaving.
What it computes
Enter a GitHub URL or just owner/repo — a link straight from the Issues or Pull Requests tab works too, the extra path gets ignored. The tool calls the GitHub API directly from your browser — nothing goes through my server — and pulls six signals automatically, all free in the same handful of requests:
- License — whether GitHub detected an OSI-style FOSS license at all. No license means “all rights reserved” by default, whatever the README claims.
- Last commit on the default branch — recency as a proxy for whether the project is still alive.
- Contributors — GitHub’s public API has no “maintainer” role, so contributor count is the closest available proxy for bus factor. A repo with one contributor is one resignation away from unmaintained.
- Stars and forks — weak signals individually, but forks in particular filter out pure bookmarking: forking means someone actually built on the code.
- Repo age — shown for context, not scored. Old can mean stable or abandoned; young can mean fresh or immature — there’s no clean “good” direction here.
Each scored signal is weighted and combined into a 0–100 score. A missing or non-FOSS license caps the score hard, regardless of how good the other numbers look — a popular, actively maintained repo with no license is still a legal problem, arguably a bigger one because people assume it’s fine.
Optional deeper checks
Four more signals sit behind checkboxes, off by default, because each costs an extra GitHub API call against the 60/hour anonymous budget:
- Community profile health — GitHub’s own composite score for whether README, LICENSE, CONTRIBUTING and a security policy exist.
- Public security advisories — published GHSA entries against the repo. A public critical advisory caps the score the same way a missing license does.
- Bus factor — the top contributor’s share of total commits, pulled from commit stats rather than the raw contributor list. A repo can show “12 contributors” and still be 95% one person; this catches that.
- Commit trend — commit volume over the last 12 weeks, to tell sustained activity apart from a single commit that revived an otherwise dead repo right before you looked.
Check any of these on and the score folds them in with the rest; leave them off and the core six still give a reasonable read.
What it doesn’t do
It doesn’t read the code, look at the issue tracker, or check whether the license terms fit your use case (GPL vs. a proprietary product is a different conversation than GPL vs. an internal tool). Anonymous GitHub API calls are capped at 60 requests/hour per IP; if you hit that limit, paste a personal access token (no scopes needed for public repos) — it stays in your browser and goes straight to api.github.com.
Treat the score as a filter for the obvious no’s, not a substitute for actually reading the license and skimming the commit history yourself.