Independent analytics for a public GitHub repository
A collection of my Semgrep rules to facilitate vulnerability research. — view on GitHub · semgrep.dev
Language
C
License
MIT
open source
Created
Mar 2022
Stars
874
Forks
91
Issues
5 open
Updated 21 Sept 2026, 11:23 UTC
tracker score 57/100 methodology →
Computed from release cadence, responsiveness, backlog trend and contributor depth.
Last release
98 days ago
v2.0.0
Cadence
every 72.6d
on pacePR merge median
0.0d
Issue response median
13.2h
Commits / 7d
1
The signature question of dependency due diligence. Columns: commits per month (activity). Line: merged pull requests per month (delivery). 12 full months.
Reading: delivery held at ~0 merged PRs/mo over the last 12 months. No divergence risk — delivery tracks attention.
How fast maintainers answer, review and merge — ranked against repos of similar size and age.
Issue first non-author response
median 13.2hcohort: n/aPR first review
median 8.3hcohort: n/aPR merge time
median 0.0dcohort: n/aBots excluded Sample: 5 merged PRs (90d) / 9 recent issues. Percentile position measured from the left — shorter is faster.
1
first-time PRs (12 mo)
—
got a response
n=4 scanned
—
were merged
1 newcomer candidates
—
returned ≤90d
verified via author historyVerdict: not enough first-time PRs in the sampled window (2026-03-25..2026-06-23) to call this either way — most contributions here come from people already close to the project.
top 1 — 99.6% of accepted changes · last commit Aug 2
top 3 — 100% of accepted changes
long tail — 0 further authors
Verdict: high key-person risk. 2 human commit authors in 12 months; top author (0xdea) holds 99.6%, top 3 hold 100%, 1 authors above 1% each.
Open issues and pull requests right now. Trend history builds from daily tracking.
open issues & PRs — right now
5
open issues
2
open pull requests
Tracking daily since 5 Sept 2026 — 2 snapshots so far.
7 open
5 issues + 2 PRs · trend builds as daily snapshots accumulate
91 forks · 0 with independent momentum
Harvester57/semgrep-rules — 4★ · last push 83d ago
0xdea/semgrep-rules is upstream — no successor needed (project active). Top forks by stars are all stale (pushes >1y ago). Successor detection activates if the repo goes dormant.
If this repo goes dormant, this section becomes “Where did development continue?” — with evidence labels per fork.
0 stable releases in 90d (median gap 72.6d)
Issue response sits at a 13.2h median — trend builds as daily snapshots accumulate
License unchanged · not archived · no rename/transfer
Max release gap in 12mo: 121d (cadence 72.6d median)
These answers regenerate on every snapshot — they never rot.
Yes — actively (score 57/100). Last stable release v2.0.0 98 days ago, 1 commits in the last full week, median PR merge 0.0d. Evidence collected Mon Sep 21 2026.
MIT — as reported by GitHub.
v2.0.0, 98 days ago. Median gap between stable releases is 72.6 days; 0 stable releases shipped in the last 90 days.
On the evidence: yes. 2 human authors in 12 months, no fork-succession pressure. Not published to npm — GitHub activity only.
Link preview (auto-generated OG card)
tracker.git.tools
0xdea/semgrep-rules
ACTIVELY MAINTAINED · 57/100
ships every 72.6d · PR merge 0.0d · ★ 874
0xdea/semgrep-rules — maintenance verdict & repo intelligence · tracker.git.tools
README badge (live SVG — every embed is a backlink)
[](https://tracker.git.tools/0xdea/semgrep-rules)
Badge states: active · slowing · maintenance-only · dormant — flips automatically; maintainers embed it because it’s honest.
Get an email the week this repo’s verdict changes — release droughts, response-time decay, key-person exits. Free for 3 repos. Your whole package.json monitored, on paid.
This report for your private org repos →Verdict-change alerts, release droughts, response-time decay. Free for 3 repos.
Built from the public GitHub API, the npm registry, deps.dev and Hacker News. Known bot accounts are excluded from response and merge metrics. Verdicts are computed from the evidence shown on this page — nothing is scored that you cannot see. Reports refresh daily.