# GitHub Repo Risk Score

> Paste a repo, get a first-pass risk score from license, commit activity, contributors and stars — with optional deeper checks for security advisories, bus factor and community health — before you tell a developer yes or no.

- URL: https://blog.goroot.de/tools/github-repo-risk-score/
- First published: 2026-08-18
- Lastmod: 2026-08-18
- 537 words, 3 min
- Tags: github, open-source, risk-assessment, developer-tools
- Autor: Michael Kolb — goroot (https://blog.goroot.de/)

---


A developer wants to pull a GitHub repo into the stack. You need a fast first read before you commit to the real due diligence: does it have a license you can actually use, is anyone still maintaining it, and would the project survive its one maintainer leaving.

## What it computes

Enter a GitHub URL or just `owner/repo` — a link straight from the Issues or Pull Requests tab works too, the extra path gets ignored. The tool calls the GitHub API directly from your browser — nothing goes through my server — and pulls six signals automatically, all free in the same handful of requests:

- **License** — whether GitHub detected an OSI-style FOSS license at all. No license means "all rights reserved" by default, whatever the README claims.
- **Last commit on the default branch** — recency as a proxy for whether the project is still alive.
- **Contributors** — GitHub's public API has no "maintainer" role, so contributor count is the closest available proxy for bus factor. A repo with one contributor is one resignation away from unmaintained.
- **Stars** and **forks** — weak signals individually, but forks in particular filter out pure bookmarking: forking means someone actually built on the code.
- **Repo age** — shown for context, not scored. Old can mean stable or abandoned; young can mean fresh or immature — there's no clean "good" direction here.

Each scored signal is weighted and combined into a 0–100 score. A missing or non-FOSS license caps the score hard, regardless of how good the other numbers look — a popular, actively maintained repo with no license is still a legal problem, arguably a bigger one because people assume it's fine.

### Optional deeper checks

Four more signals sit behind checkboxes, off by default, because each costs an extra GitHub API call against the 60/hour anonymous budget:

- **Community profile health** — GitHub's own composite score for whether README, LICENSE, CONTRIBUTING and a security policy exist.
- **Public security advisories** — published GHSA entries against the repo. A public critical advisory caps the score the same way a missing license does.
- **Bus factor** — the top contributor's share of total commits, pulled from commit stats rather than the raw contributor list. A repo can show "12 contributors" and still be 95% one person; this catches that.
- **Commit trend** — commit volume over the last 12 weeks, to tell sustained activity apart from a single commit that revived an otherwise dead repo right before you looked.

Check any of these on and the score folds them in with the rest; leave them off and the core six still give a reasonable read.

## What it doesn't do

It doesn't read the code, look at the issue tracker, or check whether the license terms fit _your_ use case (GPL vs. a proprietary product is a different conversation than GPL vs. an internal tool). Anonymous GitHub API calls are capped at 60 requests/hour per IP; if you hit that limit, paste a personal access token (no scopes needed for public repos) — it stays in your browser and goes straight to api.github.com.

Treat the score as a filter for the obvious no's, not a substitute for actually reading the license and skimming the commit history yourself.