Öffentliches RegisterGefährdet
Software-GesundheitsberichtSchema 0.27.0 · Metriken 1.13.0 · 2026-07-26 02:39 UTC
bugsyhewitt / unearth
Unearth the buried origin IP lurking behind Cloudflare, CloudFront, and other CDN veils. It unleashes 10 passive and active recon rituals in parallel, then weighs each suspect by cross-technique agreement and marks the strongest leads with confidence scores. No API keys required; Censys and Shodan crack open deeper graves if you dare.
bugsyhewitt/unearth erreicht einen Gesundheitsindex von 45 von 100 und liegt damit im Bereich Gefährdet. Am stärksten schneidet es bei Engineering Quality (72/100) ab, am schwächsten bei Sustainability & Governance (28/100). Zuletzt vor 10 Tagen aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
45
gesamt / 100Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
45
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Eigentümerschaft
Bugsy HewittPersönliches Konto
24 Follower40 öffentliche Reposseit Mai 2026
Dieses Repository gehört einem persönlichen Konto. Ein Projekt mit nur einem Eigentümer trägt ein höheres Kontinuitätsrisiko als ein organisationsgetragenes.
Metriken nach Kategorie
Vitalität
Lebt das Projekt — wird Code geschrieben und werden Releases ausgeliefert?
63
Entwicklungsaktivität
49Gefährdet
Wie die Bewertung erfolgt
| 28.8/36 | Push-Aktualität — letzter Push vor 10 Tagen |
| 3.5/36 | Commit-Rhythmus — 5/52 Wochen mit Commits |
| 16.6/18 | Commit-Volumen — 70 Commits im letzten Jahr |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Verwendete Eingangsdaten
| commits_last_year | 70 |
| human_commit_share | 1 |
| days_since_last_push | 10 |
| active_weeks_last_year | 5 |
Release-Disziplin
83Gut
Wie die Bewertung erfolgt
| 27/27 | Liefert Releases aus — 2 Releases veröffentlicht |
| 36/36 | Release-Aktualität — letztes Release vor 10 Tagen |
| 19.8/27 | Release-Rhythmus — ein Release etwa alle 58,2 Tage |
| 0/10 | OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases. |
Verwendete Eingangsdaten
| releases_count | 2 |
| latest_release_tag | v1.1.0 |
| releases_from_tags | nein |
| days_since_latest_release | 10 |
| mean_days_between_releases | 58,2 |
Community & Verbreitung
Hat das Projekt Nutzer, Downloads, Aufmerksamkeit und ein einladendes Umfeld für Beitragende?
29
Popularität & Verbreitung
11Kritisch
Wie die Bewertung erfolgt
| 11.3/60 | Stars — 6 Stars |
| 0/25 | Forks — 1 Forks |
| 0/15 | Watcher — 0 Watcher |
Verwendete Eingangsdaten
| forks | 1 |
| stars | 6 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community-Gesundheit
50Mittel
Wie die Bewertung erfolgt
| 22.5/22.5 | README |
| 22.5/22.5 | Lizenz — anerkannte Lizenz (MIT) |
| 0/18 | CONTRIBUTING-Leitfaden |
| 0/13.5 | Verhaltenskodex |
| 0/7.2 | Issue-Vorlage |
| 0/6.3 | PR-Vorlage |
Verwendete Eingangsdaten
| has_readme | ja |
| has_license | ja |
| has_contributing | nein |
| has_issue_template | nein |
| has_code_of_conduct | nein |
| has_pull_request_template | nein |
Nachhaltigkeit & Governance
Überdauert das Projekt die Menschen, die es tragen — Bus-Faktor, Reaktionsfähigkeit, Trägerschaft und Paketpflege?
28
Maintainer-Resilienz (Bus-Faktor)
10Kritisch
Wie die Bewertung erfolgt
| 9/54 | Bus-Faktor — 1 Beitragende decken die Hälfte aller Commits ab |
| 0/22.5 | Commit-Verteilung — wichtigste beitragende Person verfasste 100 % der Commits |
| 1.4/13.5 | Breite der Beitragenden — 1 Beitragende |
| 0/10 | OpenSSF Scorecard: Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
Verwendete Eingangsdaten
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Reaktionsfähigkeit bei Issues & PRs
38Gefährdet
Wie die Bewertung erfolgt
| 0/46.8 | Issue-Lösungsquote — 0 % der Issues geschlossen |
| 38.2/38.3 | PR-Annahme — 45/45 entschiedene PRs gemergt |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Verwendete Eingangsdaten
| merged_prs | 45 |
| open_issues | 1 |
| closed_issues | 0 |
| issue_closed_ratio | 0 |
| closed_unmerged_prs | 0 |
Eigentümerschaft & Trägerschaft
40Gefährdet
Wie die Bewertung erfolgt
| 10/30 | Organisatorische Trägerschaft — persönliches (Nutzer-)Konto |
| 0/20 | Verifizierte Domain — für Nutzerkonten nicht anwendbar |
| 10.1/25 | Reichweite des Inhabers — 24 Follower von bugsyhewitt |
| 12.2/25 | Kontohistorie — 40 öffentliche Repos, Kontoalter ca. 0 Jahre |
Verwendete Eingangsdaten
| followers | 24 |
| owner_type | User |
| is_verified | — |
| owner_login | bugsyhewitt |
| public_repos | 40 |
| account_age_days | 84 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Verifizierte Domain. Die verbleibenden Gewichte wurden renormalisiert.
Engineering-Qualität
Sind grundlegende Engineering- und Dokumentationspraktiken vorhanden?
72
Wie die Bewertung erfolgt
| 24/24 | CI-Workflows — 2 Workflow(s) |
| 24/24 | Tests vorhanden |
| 16/16 | Linter-Konfiguration — .golangci.yml |
| 0/9.6 | Pre-Commit-Hooks |
| 6.4/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — 0 out of 26 merged PRs checked by a CI test -- score normalized to 0 |
Verwendete Eingangsdaten
| has_ci | ja |
| has_tests | ja |
| has_editorconfig | ja |
| has_linter_config | ja |
| has_precommit_config | nein |
Dokumentation
75Gut
Wie die Bewertung erfolgt
| 30/30 | README |
| 25/25 | Dokumentationsverzeichnis |
| 0/15 | Dokumentations-/Homepage-Site |
| 10/10 | Repository-Beschreibung |
| 0/10 | Topics |
| 10/10 | Wiki |
Verwendete Eingangsdaten
| topics | — |
| has_wiki | ja |
| homepage | — |
| has_readme | ja |
| has_docs_dir | ja |
| has_description | ja |
Sicherheit
Sind die sichtbaren Sicherheits- und Lieferkettenpraktiken belastbar, ohne ungeklärte Exposition gegenüber Hochrisikojurisdiktionen?
30
Sicherheitslage
30Gefährdet
Wie die Bewertung erfolgt
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — 0 out of 26 merged PRs checked by a CI test -- score normalized to 0 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | Lizenz — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — Project has not signed or included provenance with any releases. |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 6.8/7.5 | Vulnerabilities — 1 existing vulnerabilities detected |
Verwendete Eingangsdaten
| source | openssf_scorecard |
| checks_evaluated | 18 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 0 |
| scorecard_aggregate | 3 |
AI Readiness
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
70
AI-Agentenkontext & Leitlinien
40Gefährdet
Wie die Bewertung erfolgt
| 0/45 | Agentenanweisungen — keine CLAUDE.md / AGENTS.md / Editor-Regeln |
| 0/15 | Maschinenlesbare Doku (llms.txt) |
| 40/40 | Lesbare Commit-Historie — 65 von 70 menschlichen Commits benennen ihre Absicht (strukturierter Betreff oder erläuternder Text) |
Verwendete Eingangsdaten
| has_llms_txt | nein |
| legible_history_share | 0,929 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Wie die Bewertung erfolgt
| 18/18 | Bootstrap mit einem Befehl — Makefile |
| 22/22 | Automatisierte Tests |
| 11/11 | Lint-/Format-Konfiguration — .golangci.yml |
| 11/11 | Statische Typprüfung — Go (statisch typisiert) |
| 10/10 | Reproduzierbare Umgebung — lockfile |
| 10/10 | Belegte Agentenpraxis — 36 der letzten 70 Commits von Agenten verfasst oder ihnen zugeschrieben |
| 0/8 | Automatisierte Wartung — keine automatisierten Abhängigkeits-Updates beobachtet |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Verwendete Eingangsdaten
| has_nix | nein |
| has_tests | ja |
| lockfiles | go.sum |
| has_dockerfile | nein |
| typed_language | ja |
| bootstrap_files | Makefile |
| has_devcontainer | nein |
| has_linter_config | ja |
| typecheck_configs | — |
| agent_commit_share | 0,514 |
| toolchain_manifests | go.mod |
| dependency_bot_commit_share | 0 |
AI-Code-Lesbarkeit für Modelle
100Exzellent
Wie die Bewertung erfolgt
| 45/45 | Typprüfbarer Code — Go (statisch typisiert) |
| 55/55 | Handhabbare Dateigrößen — 0/111 Quelldateien über 60 KB |
Verwendete Eingangsdaten
| primary_language | Go |
| largest_source_bytes | 50.908 |
| source_files_sampled | 111 |
| oversized_source_files | 0 |
Eckdaten
6GitHub-Sterne
1Mitwirkende
70Commits, letzte 12 Monate
10Tage seit letztem Push
2Releases
1Bus-Faktor
1offene Issues
GoPaket-Ökosysteme
Warnungen zur Datenerhebung
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- Could not fetch go package 'github.com/unearth-tool/unearth' from its registry
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Weitere Details
OpenSSF Scorecard 3.0 / 10
3.0Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 0 | CI-Tests | 0 out of 26 merged PRs checked by a CI test -- score normalized to 0 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| 0 | Signed-Releases | Project has not signed or included provenance with any releases. |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 9 | Vulnerabilities | 1 existing vulnerabilities detected |
Direkte Abhängigkeiten 5
| Registry | Paket | Versionsvorgabe | Manifest |
|---|---|---|---|
| Go | github.com/mark3labs/mcp-go | v0.48.0 | go.mod |
| Go | github.com/spf13/cobra | v1.10.2 | go.mod |
| Go | golang.org/x/time | v0.5.0 | go.mod |
| Go | gopkg.in/yaml.v3 | v3.0.1 | go.mod |
| Go | modernc.org/sqlite | v1.30.2 | go.mod |
Alle Abhängigkeiten nicht erhoben
Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 455,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 876389,
"Makefile": 603
},
"pushed_at": "2026-07-15T23:52:51Z",
"created_at": "2026-05-16T04:13:01Z",
"owner_type": "User",
"updated_at": "2026-07-15T23:52:55Z",
"description": "Unearth the buried origin IP lurking behind Cloudflare, CloudFront, and other CDN veils. It unleashes 10 passive and active recon rituals in parallel, then weighs each suspect by cross-technique agreement and marks the strongest leads with confidence scores. No API keys required; Censys and Shodan crack open deeper graves if you dare.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "v3x.tech",
"name": "Bugsy Hewitt",
"type": "User",
"login": "bugsyhewitt",
"company": null,
"location": null,
"followers": 24,
"avatar_url": "https://avatars.githubusercontent.com/u/281210152?v=4",
"created_at": "2026-05-02T16:01:55Z",
"is_verified": null,
"public_repos": 40,
"account_age_days": 84
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-07-15T08:30:11Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2026-05-18T03:25:03Z"
}
],
"recent_commits": [
{
"oid": "c0c546ca5dc5433cba621e35ef0e3b694b5164b3",
"body": "…ig_test\n\ngofmt: txtleak.go, otxpdns.go, config_test.go (missed by prior lint pass;\ntxtleak.go and config_test.go were touched by the simplify sweep).\n\nSA1019: CensysAPIID/CensysAPISecret are deprecated-but-kept fields (their own\ndocstrings say 'a later cleanup packet will remove it'). Add a scoped\ngolangci exclusion for SA1019 in pkg/config/config_test.go rather than\npeppering the test file with nolint directives.\n\nBuild and vet verified clean.",
"is_bot": false,
"headline": "fix(lint): gofmt remaining files, suppress intentional SA1019 in conf…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T23:52:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0a60ab3185c3206b39fbfba6fa3f1ab10ed719e8",
"body": "gofmt: re-format root.go, output.go, cli_test.go (tabs/whitespace drift).\n\nstaticcheck S1008 (cdn.go): simplify trailing if/return-true/return-false\npatterns in isGcoreHeaders and isEdgioHeaders to a direct return expression.\n\nrevive redefines-builtin-id (emailheader.go): rename local const max→maxL\n[…]\nr \"passivedns\"\nwhich the misspell tool incorrectly treats as a misspelling of \"passives\";\npassivedns is an established domain compound used throughout the suite.\n\nBuild and vet verified clean locally.",
"is_bot": false,
"headline": "fix(lint): resolve all pre-existing golangci-lint failures",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T23:50:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "83df52656f3151ed506b8ccd45eca47fd1e98bb4",
"body": "…, knownTechniques\n\n- Move publicOriginAddr (txtleak.go) to isPublicOriginAddr in helpers.go,\n the shared helper location; eliminates a third copy of the same private-\n address classifier alongside isPrivateAddr (emailheader) and isUnroutable\n (errorpage).\n- Extract techHitNames helper in output.\n[…]\na manual entry here to\n avoid spurious unknown-technique warnings.\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "simplify(unearth): quality sweep — dedup address filter, techHitNames…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T22:36:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7061802bb83295f25a8b8e04f589817b52f38537",
"body": null,
"is_bot": false,
"headline": "docs: add comic card image to README header",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T21:16:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fcd073e19e511008d4bdaf3f708b441bcee429f4",
"body": "…, knownTechniques (#45)\n\n- Move publicOriginAddr (txtleak.go) to isPublicOriginAddr in helpers.go,\n the shared helper location; eliminates a third copy of the same private-\n address classifier alongside isPrivateAddr (emailheader) and isUnroutable\n (errorpage).\n- Extract techHitNames helper in o\n[…]\na manual entry here to\n avoid spurious unknown-technique warnings.\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "simplify(unearth): quality sweep — dedup address filter, techHitNames…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T19:16:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b9caf8c1c95ebaa7fdded6ae9ae98803e0b24a61",
"body": "* release: cut v1.1.0\n\nBumps version string from 0.1.0-dev to 1.1.0 and promotes the\n[Unreleased] CHANGELOG section to [1.1.0] (2026-07-15).\n\nv1.0.0 was tagged at the initial release (2026-05-17, commit bef8eaf).\nThe 45 subsequent commits added 20 new discovery techniques (greynoise_asset,\notx_passi\n[…]\nchnique, --pipeline-batch, calibrate\nsubcommand, and several credential-env and favicon-hash bug fixes. All\n10 test packages pass with -race.\n\n* chore: add v1.1.0 release output.md and test-output.txt",
"is_bot": false,
"headline": "v1.1.0 release (#44)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T08:30:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "efe4c5c222cb0933815d6bf5da05eeabf7ebabcc",
"body": "…run (#43)\n\nAdds --exclude-technique <name>[,<name>...] (repeatable StringSlice flag)\nto the CLI and ExcludeTechniques []string to unearth.Options. Unknown names\nproduce a Warnings entry rather than a hard error. 7 new tests across the\nengine and CLI packages; all 10 packages pass under -race.",
"is_bot": false,
"headline": "feat(cli): add --exclude-technique flag to skip named techniques per …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T07:49:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03a1a4a80617abd43833bd752cea42f449f1200a",
"body": "Hide candidates below a supplied score threshold across all four output\nformats (jsonl, json, table, sarif). Default 0 = show all (no change to\nexisting behaviour). Validates range [0.0, 1.0] at parse time.\n\nFiles changed:\n- cmd/unearth/internal/cli/root.go: new flag + validation\n- cmd/unearth/inter\n[…]\nw tests\n- cmd/unearth/internal/cli/extra_test.go: TestFilterByConfidence unit test\n- README.md: document flag in CLI reference and quick-start\n\nAll 10 packages pass under go test ./... -count=1 -race.",
"is_bot": false,
"headline": "feat(cli): add --min-confidence threshold filter (#42)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T06:48:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7822855166fc417da593a764562e0591d9f99bf8",
"body": "…integration (#41)\n\nAdd `-o sarif` output format that emits a SARIF 2.1.0 document with one\nresult per candidate IP. Each result carries rule UNEARTH001, a level\nderived from the confidence score (error ≥0.80, warning ≥0.50, note\n<0.50), a logicalLocation of the target domain, and a properties bag\nw\n[…]\n cap, multi-target\naggregation, and the sarifLevel helper directly.\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(output): add SARIF 2.1.0 output format for GitHub Code Scanning …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T06:27:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b013cc4484bc3674aeaf191f40b68f06d7bf3724",
"body": "… and CredentialStatus coverage (#40)\n\nFive credential sets (ZoomEye, Chaos/PDCP, VirusTotal, URLScan, GreyNoise)\nwere missing from allCredentialEnvVars in pkg/config/config_test.go. Tests\ncalling clearCredentialEnv did not clear these vars, so a real GREYNOISE_API_KEY\n(for example) in a CI shell co\n[…]\nnd expand the brief technique list to name JARM and ASN-range sweep\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test(config): fix credential env-isolation gap; extend canonical-name…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T06:10:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3925e9302fe2e3fb24deabdd202cc13147cf26d0",
"body": "…n_hash pre-filter bug (#39)\n\nSeven techniques shipped after v1.0 (split_dns, email_header, jarm_fingerprint,\nasn_sweep, shodan_cve, favicon_hash, dns_txt_leak) were never added to\nknownTechniques or the default-weights YAML files, so users who tried to\noverride their weights received spurious \"unkn\n[…]\nKeyFor_FaviconHash, TestHasKeyFor_AllKeyRequiringTechniquesCovered.\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(config): wire post-v1.0 techniques into config system; fix favico…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T05:42:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8014c2f37baa2ad4b71f1e5099f562eff225a35b",
"body": "…38) (#38)\n\nThree new tools in unearth-mcp give AI agents low-overhead introspection\nand filtering capabilities without running a full discovery pipeline:\n\n- unearth_check_cdn: CDN fingerprinting for a hostname using the same\n DNS/IP-range/header detection as the discovery engine; surfaces the\n CD\n[…]\nded to cmd/unearth-mcp/main_test.go; all pass.\nMCP server grows from five to eight tools. POST_V01.md updated to mark\nP2 FOFA/Netlas/CriminalIP, P3 pipeline-batch, and P3 MCP expansion as\nimplemented.",
"is_bot": false,
"headline": "feat(mcp): add check_cdn, is_cdn_ip, list_techniques utility tools (#…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T04:05:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2a581744429eea498b5fcfc04f013cd008a74bda",
"body": "…hnique (#37)\n\n- Implement JARM 10-probe active technique in pkg/techniques/jarm.go; self-\n contained pure-Go port of the Salesforce JARM algorithm with no new external\n dependency (no jarm-go module required).\n- Weight corrected to 0.80 per spec (was 0.70); all 12 unit tests updated.\n- Known CDN-\n[…]\nws from RunOptions.SeedIPs like host_header.\n- README techniques table updated: weight 0.70 → 0.80.\n- POST_V01.md: P2 jarm_fingerprint section marked ✅ IMPLEMENTED with\n implementation summary block.",
"is_bot": false,
"headline": "feat(techniques): ship jarm_fingerprint active TLS fingerprinting tec…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T02:43:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "84b0724af806769bc431dd2a39c6ec5eeb9fd429",
"body": "Both techniques shipped in prior laps (f22984b / 6bb8904) but\nPOST_V01.md was not updated with the ✅ IMPLEMENTED markers.",
"is_bot": false,
"headline": "docs(POST_V01): mark asn_sweep and split_dns as implemented (#36)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T02:10:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34a205f4da98dd2874bf91d95a0ee588ad938b5c",
"body": "…e (necro-phase2-r1) (#34)\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(unearth): add dns_txt_leak passive TXT-record origin-IP techniqu…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-06-05T19:20:19Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7c21ac76218e5040c6ab675cb7b2e316b0acee43",
"body": "Add two widely-used CDN providers that were previously missing from the\nfilter, causing Vercel- and Netlify-hosted origins to appear as unfiltered\ncandidates in scan results.\n\n- Embed IPv4/IPv6 CIDR ranges for Vercel (AS13335-edge) and Netlify (AS137954)\n- Add buildVercel()/buildNetlify() with canon\n[…]\nproviders in init() after cachefly\n- 22 new tests: IP range, DNS hint, and header detection for both providers\n\nCloses #36\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(cdn): add Vercel Edge Network and Netlify CDN providers (#33)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-06-05T15:02:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "32920fa2b85bb0092210cdfc5c8b5da4954107d5",
"body": "…#32)\n\nAdds greynoise_asset, the 17th asset-discovery technique, querying\nGreyNoise's GNQL search for IPs whose rDNS or organization metadata\nself-advertises under the target apex. A sensor-observed-noise pivot\northogonal to every existing backend: the IP must be currently live\n(GreyNoise sensors ob\n[…]\nufficient). Pagination via scroll cursor with a\n10-page ceiling. Results cached 1h.\n\nCo-authored-by: unearth-worker <worker@necromancer.local>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add greynoise_asset sensor-observed-noise backend (…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T04:19:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e7afe2d1110bf7075f6006cf8437d8ac7c8ba70f",
"body": "Sixteenth asset-discovery backend. Inverts shodan_cert's signal: rather\nthan requiring the candidate host to reuse the front-door TLS\ncertificate, it requires the candidate host to expose a specific known\nvulnerability. Given an operator-supplied CVE id (--cve flag) and the\ntarget apex, queries Shod\n[…]\ndates) mirroring\nthe email_header operator-supplied-scope idiom.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add shodan_cve discovery technique (#31)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T03:22:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "02e371b2563e1816e69698e5c4758b430bd13c76",
"body": "Adds the fifteenth asset-discovery backend, intentionally orthogonal to\ncensys_cert. Where censys_cert pivots on the target's TLS leaf-certificate\nSHA-256 (and so only surfaces hosts that reuse the front-door certificate),\ncensys_ipv6 pivots on the target's DNS apex via the Censys Platform\nhost.dns.\n[…]\nGELOG.md unreleased entry added\n\nTest suite: go test ./... — all packages pass.\n\nCo-authored-by: unearth-worker-r33 <worker@necromancer.local>\nCo-authored-by: Claude Sonnet 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add censys_ipv6 IPv6 asset-discovery backend (#30)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T02:06:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "31671cb0a338bd495a11abc303bc5e4ead689d30",
"body": "… backend (#29)\n\nThe fourteenth asset-discovery backend. AlienVault OTX passive-DNS\nqueries (GET /api/v1/indicators/domain/{domain}/passive_dns) surface\nhistorical hostname-to-IP observations from OTX's honeypot/sensor\nnetwork, community-submitted analyst pulse feeds, and partner DNS\ntelemetry. Diff\n[…]\ny update\n- docs/techniques.md detailed section\n- CHANGELOG entry\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add otx_passivedns keyless threat-intel passive-DNS…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T00:43:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1f86d032b239554beb4d9b1e70f82e3f99459f9b",
"body": "…end (#28)\n\nShips the 13th OSINT asset-discovery backend, urlscan_asset (passive tier,\nweight 0.66). Like fullhunt_asset, zoomeye_asset, chaos_asset, and\nvirustotal_passivedns -- and unlike the eight cert-fingerprint engines --\nthis is not a cert pivot. It queries URLScan.io's /api/v1/search/ endpoi\n[…]\nonfigs/default-weights.yaml so the embed-vs-source guard passes.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add urlscan_asset browser-scan asset-discovery back…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T00:28:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "82854303166a405e06437a1773891457719c3f3e",
"body": "…end (#27)\n\nThe twelfth asset-discovery backend, and the fourth non-cert-pivot enumerator\nalongside fullhunt_asset, zoomeye_asset, and chaos_asset. Queries VirusTotal's\nv3 /domains/{domain}/resolutions endpoint for every historical hostname->IP\nobservation in its passive-DNS corpus and emits the non\n[…]\nrsor pagination.\nFull suite green with -race: 538 passing tests.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add virustotal_passivedns temporal passive-DNS back…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T22:14:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f92b6ebe9ad61699556fe47a99e65db5886f395b",
"body": "…nd (#26)\n\nThe eleventh asset-discovery backend and the eighth independent\ncertificate-pivot engine. The two backends originally suggested for this\nslot — BinaryEdge and LeakIX — were already shipped (`binaryedge_cert`\n0.72 and `leakix_cert` 0.71). Onyphe (onyphe.io) was selected as the\nnext-best un\n[…]\nboration weight pending\ncalibration.\" The calibrate subcommand will refine this weight from\nreal-world corroboration data.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(techniques): add onyphe_cert EU-weighted certificate-pivot backe…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T21:10:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "56510424d664861df6529d28d08246e774691273",
"body": "…backend (#25)\n\nAdd chaos_asset, the tenth asset-discovery backend, querying ProjectDiscovery's\nChaos dataset (the corpus behind subfinder). Verified neither Mercury/Chaos nor\nCensys Communities was already shipped; Censys Communities was rejected as too\nclose to the shipped censys_cert (Censys Plat\n[…]\nHANGELOG.\n\ngo test -race ./... is green; go vet and gofmt clean.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add chaos_asset ProjectDiscovery subdomain-dataset …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T20:11:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4118cb60da668123f0c431df57b3ea969b773e6e",
"body": "…tion backend (#24)\n\nAdds ZoomEye as the ninth passive recon backend (passive tier, weight 0.68).\nLike fullhunt_asset, and unlike the seven cert-fingerprint engines, this is a\ndomain host enumerator rather than a cert pivot: it queries ZoomEye's\ndomain-search API for the associated hosts crawled und\n[…]\nys section, and explanatory\nnote updated; CHANGELOG entry added.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add zoomeye_asset APAC-coverage domain host-enumera…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T19:08:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3e98560b419245900793bb2511dcc5071bd7c16c",
"body": "…backend (#23)\n\n* feat(techniques): add leakix_cert SHA-1 certificate-fingerprint pivot\n\nAdd LeakIX (leakix.net) as the seventh independent cert-pivot backend,\nalongside censys/shodan/fofa/netlas/criminalip/binaryedge. It fingerprints\nthe target's TLS leaf cert (SHA-1, the Shodan/BinaryEdge flavor) \n[…]\nuthored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add fullhunt_asset attack-surface host-enumeration …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T18:05:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "17bb8f0830cff42e0769992d9011bde3948fe92a",
"body": "…ivot (#22)\n\nAdd BinaryEdge as a sixth independent certificate-pivot backend alongside\ncensys_cert, shodan_cert, fofa_cert, netlas_cert, and criminalip_asset.\nbinaryedge_cert (passive, weight 0.72) fingerprints the target's TLS leaf\ncert SHA-1 and queries the BinaryEdge host-search API for every sca\n[…]\nalip previously fell to\nthe default false branch and never ran).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add binaryedge_cert SHA-1 certificate-fingerprint p…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T14:54:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "cd9f40a5808f648a71d780d345e23611fc6966d9",
"body": "The README instructed users to export CENSYS_PLATFORM_PAT, SHODAN_API_KEY,\nSECURITYTRAILS_API_KEY, VIEWDNS_API_KEY, FOFA_EMAIL/FOFA_KEY, NETLAS_API_KEY,\nand CRIMINALIP_API_KEY, but LoadAPIKeys only read the UNEARTH_-prefixed\naliases. Any user following the docs had their keys silently ignored and ev\n[…]\n and documents the\nalias precedence in the README and CHANGELOG.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: honor documented API-key env var names (#21)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T13:36:04Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0073801103a2e6824f919de5d15657d1b67d72c1",
"body": "Add Criminal IP (criminalip.io) as the fifth passive cert-fingerprint\npivot backend alongside censys_cert, shodan_cert, fofa_cert, and\nnetlas_cert. Fingerprints the target's TLS leaf cert (SHA-256) and\nqueries the Criminal IP banner search API for assets presenting the\nsame fingerprint, surfacing no\n[…]\n error\nclassification path) plus a config CredentialStatus test.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add criminalip_asset cert-fingerprint pivot (#20)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T12:35:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a544fcf8d556ae7f6fb1b196197a6aa0fbb19892",
"body": "Add the Netlas (netlas.io) certificate-fingerprint pivot as the next P2\nsearch backend, paralleling censys_cert, shodan_cert, and fofa_cert. It\nfingerprints the target's TLS leaf cert (SHA-256), queries Netlas's response\nindex for hosts sharing the fingerprint, and emits non-CDN hits as origin\ncandi\n[…]\nnto config, default weights (both copies),\ncredential reporting, the CLI status banner, and the MCP cert-fingerprint tool.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(techniques): add netlas_cert certificate-fingerprint pivot (#19)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T11:33:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "98071ddabbfe166ce6ec814326513a025654fec5",
"body": "…h3 (#18)\n\nThe github.com/spaolacci/murmur3 v1.1.0 dependency performs unsafe\npointer arithmetic in Sum32WithSeed that trips Go's -race / checkptr\ninstrumentation (\"checkptr: pointer arithmetic result points to invalid\nallocation\"), crashing the favicon_hash test under the race detector and\nkeeping \n[…]\nependency from go.mod/go.sum.\n\ngo test -race ./... is now green.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(favicon): replace murmur3 dep with pointer-safe pure-Go MurmurHas…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T10:27:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e36caa11427e5ee82e1d5e22da767d1d288ec4ae",
"body": "Add fofa_cert, a passive cert-fingerprint pivot technique that queries\nFOFA (fofa.info) for hosts presenting the target's TLS leaf-cert SHA-256,\nmirroring the existing censys_cert / shodan_cert pattern. FOFA's 4B+ asset\nindex has substantially heavier APAC scan coverage than the US-centric\nShodan an\n[…]\nappy path,\nboth-keys-required skip, empty/quota/bad-cred/403/generic-error/malformed\npaths, port stripping, and metadata).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(techniques): add fofa_cert FOFA certificate-fingerprint pivot (#17)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T09:28:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "be7bd3cab470e8128c5433bc6d18fe7a8bf731bd",
"body": "Adds CacheFly to the CDN provider registry so its edge IPs are filtered\nout of origin-candidate lists and surfaced as a recognized CDN.\n\nDetection signals (all non-colliding with existing providers):\n- IP ranges: AS30081 blocks (205.234.0.0/19, 204.93.150.0/23,\n 204.93.157.0/24, 2620:e6::/32). The \n[…]\nThe TestNoDuplicatePrefixAcrossProviders\ncollision guard passes.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add CacheFly (CacheNetworks) provider detection (#16)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T08:15:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "860de2bdce36fdaa027c9398d0e216e721d7f3c7",
"body": "Add Gcore (G-Core Labs S.A., AS199524) to the CDN provider registry so\nits edge IPs are filtered from origin candidates instead of polluting\nresults. Detection uses embedded edge ranges, gcdn.co/gcorelabs.com/\ngcore.com CNAME suffixes, the Server: gcore marker, the X-Gcore-* header\nfamily, and an X-\n[…]\nregistry-wide\nTestNoDuplicatePrefixAcrossProviders guard passes.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add Gcore (G-Core Labs) provider detection (#15)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T07:18:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "35fe0665b2f602bf60619c3ed60fd1904fd52c78",
"body": "KeyCDN (proinity GmbH, AS199653) is now a recognized CDN provider, so its\nedge IPs are filtered from origin candidates instead of polluting results.\nDetection uses embedded edge ranges, the kxcdn.com/keycdn.com CNAME\nsuffixes, the Server: keycdn-engine marker, X-Edge-Location and X-Pull\nheaders, and\n[…]\nCDN-\nexclusive; the registry-wide duplicate-prefix guard passes.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add KeyCDN provider detection (#14)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T06:15:40Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d07ddc47be477e22738ae525b79e3a37d2c770e4",
"body": "Edgio — the 2022 merger of Limelight Networks and Edgecast (Verizon\nMedia) — is the highest-traffic-share enterprise CDN still unmodeled\nafter CDN77. Adding it to the registry stops its edge IPs from polluting\norigin candidates.\n\nDetection is fully self-contained (no API key, no new dependency):\nemb\n[…]\nDME CDN\ncoverage, CHANGELOG, and the POST_V01 landscape summary.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add Edgio (Limelight / Edgecast) CDN detection (#13)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T05:14:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "37c926eecc4f2e13a4b5648b8f6e6b8c772a735f",
"body": "Adds CDN77 as a recognized provider in the CDN registry so its edge IPs\nare filtered from origin candidates instead of polluting results.\n\nDetection mirrors the existing BunnyCDN / StackPath pattern exactly:\nembedded edge IP ranges (AS60068, DataCamp Limited / CDN77 s.r.o.), the\ncdn77.org / cdn77-ss\n[…]\n traffic in that block unreachable. Removed the erroneous entry.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add CDN77 (DataCamp) detection (#12)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T04:06:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e7d3d9dc40afbff956c6640c88bbfb44837f43ff",
"body": "BunnyCDN is now a recognized provider in the CDN registry, so its edge\nIPs are filtered from origin candidates instead of polluting results.\n\nDetection signals:\n- Embedded edge IP ranges (primary ASN AS200325, BunnyWay d.o.o.)\n- b-cdn.net / bunnycdn.com / bunny.net CNAME suffixes\n- Server: BunnyCDN-\n[…]\nor, Google Cloud CDN, and StackPath/Highwinds providers exactly.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add BunnyCDN (bunny.net) detection (#11)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T02:58:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "577af9fab7dcbf9ad7c5d0077bb41a59aeabc385",
"body": "Add StackPath (formerly Highwinds Network Group / NetDNA / MaxCDN) to the\nCDN provider registry so its edge IPs are filtered from origin candidates\ninstead of polluting discovery results.\n\nDetection signals:\n- embedded Highwinds edge ranges (ASNs AS20446 / AS33438)\n- stackpathcdn.com / stackpathdns.\n[…]\n Cloud CDN providers.\n\nTests: 343 -> 348 (cdn package 44 -> 49).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add StackPath/Highwinds CDN detection (#10)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T00:05:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "73689ea17aa724dbbec272572f8d7d72c4c7f56a",
"body": "Adds Google Cloud CDN (Google Front End / global external HTTP(S) load\nbalancer) as a recognized provider in the CDN registry so its anycast\nand GFE edge IPs are filtered from origin candidates instead of\npolluting results — the next CDN coverage gap named in POST_V01.md.\n\nDetection signals, mirrori\n[…]\n\nIPv4/IPv6 range matching, DNS hints, and header classification.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add Google Cloud CDN detection (#9)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T23:06:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "55d7ac1ba500f4708fe8820eed95c4299707703b",
"body": "Azure Front Door is now a recognized provider in the CDN registry, so its\nanycast edge IPs are filtered from origin candidates instead of polluting\nresults. Detection uses embedded AzureFrontDoor service-tag ranges, the\nazurefd.net/azureedge.net/t-msedge.net/trafficmanager.net CNAME suffixes,\nthe pr\n[…]\n in the\nPOST_V01 landscape summary alongside Akamai and Imperva.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: add Azure Front Door CDN/WAF detection (#8)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T22:14:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8d2bf40cf631d2a92e29cb0dff6b6b496c803e18",
"body": "Imperva is a top-tier enterprise WAF/CDN that was missing from the CDN\nregistry, so its edge IPs were surfaced as origin candidates by the\ncert- and subdomain-based techniques, polluting results for any\nImperva-fronted target.\n\nAdd it as a provider mirroring the Akamai pattern: embedded edge IP\nrang\n[…]\nCHANGELOG, and POST_V01.md (also marks Akamai coverage shipped).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add Imperva (Incapsula) CDN/WAF detection (#7)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T21:26:48Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "14468c22bd144c71aaaec2ab0b055d61284f83db",
"body": "…3) (#6)\n\nRecord a per-technique observation after each discovery run — whether the\ncandidate that technique surfaced was corroborated by another technique in\nthe same run — and add `unearth calibrate` to turn that accumulated history\ninto per-technique precision estimates and suggested weight overr\n[…]\nort and\nnever affects discovery; --no-cache runs record nothing.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(calibrate): weight auto-calibration from run history (POST_V01 P…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T20:43:33Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b4b26a3698599718743127d287f6a51d89146b82",
"body": "…(#5)\n\nImplements the P3 \"Bulk target parallelism (pipeline mode)\" direction from\nPOST_V01.md. List/stdin runs previously processed targets strictly one at a\ntime, which is slow for large subdomain pipelines (subfinder | unearth -l -).\n\n--pipeline-batch <n> runs discovery across a bounded worker poo\n[…]\n, batch-size clamping,\nand invalid-batch validation. Race-clean.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cli): add --pipeline-batch for concurrent bulk-target discovery …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T19:59:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8745581042b3510516788827bbe70517c3a682e3",
"body": "…g (#4)\n\nAdds the email_header technique (passive tier, weight 0.85), the\nhighest-ranking unimplemented POST_V01 item that needs no external API\nkey. Parses an operator-supplied raw email via net/mail, walks the\nReceived: header chain, and surfaces public non-CDN relay IPs as origin\ncandidates — mai\n[…]\n SMTP-probe variant is\ndeferred (needs operator infrastructure).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add email_header passive .eml Received-header minin…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T19:04:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "48b11092474368fb9de50a29ae2614fc050be7d6",
"body": "Implements the Salesforce JARM active server-fingerprinting method as a\nself-contained pure-Go technique (no external module dependency). It\nsends ten crafted TLS ClientHello probes to each phase-1 candidate IP,\nfolds the handshake responses into a 62-character fingerprint, and flags\ncandidates whos\n[…]\ning/ServerHello-parsing internals\noffline, with no live network.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "add jarm_fingerprint active TLS fingerprinting technique (#3)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T12:48:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6bb8904ecb78934af56216b280787fb924a34305",
"body": "Detects split-DNS / partial-proxy misconfigurations where only the www\nhostname is routed through a CDN while the apex or a mail/admin sibling\nis left in DNS-only mode pointing straight at the origin. Resolves apex\nand www to establish a CDN-fronted front door, then flags non-CDN IPs on\nthe apex and\n[…]\nentials, so the highest-ranked keyless item was shipped instead.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add split_dns partial-proxy origin detection (#2)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T12:00:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fe60d0ebc9afdd670a9818e034f548da287e64b0",
"body": null,
"is_bot": false,
"headline": "feat: Akamai CDN detection — IP ranges, CNAME suffixes, response headers",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-27T02:52:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f22984b2dede8f5269f1ff568dfedee001bc7dde",
"body": null,
"is_bot": false,
"headline": "feat: asn_sweep technique — BGPView ASN-range origin discovery",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-27T01:47:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a641747723af54a0b3160f80e0a3f66104952c4c",
"body": "Fetch the target's /favicon.ico (HTTPS with HTTP fallback), compute its\nMurmurHash3 using Shodan's convention -- mmh3(base64.encodebytes(bytes))\nas a signed int32 -- and query Shodan (http.favicon.hash) and/or Censys\n(services.http.response.favicons.hashes) for hosts sharing that favicon.\nNon-CDN hi\n[…]\nrt) miss.\nEither API key alone is sufficient; with neither configured the\ntechnique skips gracefully, matching the existing keyed techniques.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add favicon_hash origin-discovery technique",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-26T23:34:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fdb0db7bed326ab466a4a821ae2907d5dbaa90fc",
"body": "Research lap covering CDN bypass and origin-discovery landscape through\nmid-2026. Ranks 9 improvement areas (P1-P4) by signal-to-effort ratio:\nfavicon hash pivoting, ASN-range sweep, Akamai CDN coverage, FOFA/Netlas\nintegration, JARM fingerprinting, split-DNS detection, email header leak,\npipeline parallelism, and JA4 fingerprinting.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "research: add POST_V01.md with ranked post-v1.0 directions (#1)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-26T18:43:30Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bef8eafcfd9f8d3142b523390dd3a9d46d1882bd",
"body": null,
"is_bot": false,
"headline": "fix: remove invalid changelog.source field from .goreleaser.yaml",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-18T03:23:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03c8a9f34fdc2dafa39b454b887400ebbde10705",
"body": "… workflow, v1.0.0",
"is_bot": false,
"headline": "Packet 7: README, docs (techniques, mcp, ranking), CHANGELOG, release…",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-18T02:54:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6bf5a19417feded253bd4f23f9cfab411ff209cc",
"body": "… (Fastly, Sucuri)",
"is_bot": false,
"headline": "Packet 6: MCP server (5 tools, stdio transport) + CDN dataset upgrade…",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-18T02:46:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e964cbc672f936fc83eec91d5b83a0644241974",
"body": null,
"is_bot": false,
"headline": "Packet 5B: add report and create docs/reports directory",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-18T02:28:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e0c147136c1558f341f1e738c2246d11fa846911",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-17T14:36:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7ca26b96a76b65daff76791708afac286d1dbe19",
"body": null,
"is_bot": false,
"headline": "chore: nudge GitHub contributor-stats cache",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-17T14:04:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed034e60cfe4ce18e34b8ef89141df7b5016b909",
"body": "Adds the keyless cert-pivot capability that makes the free tier\nuseful, hardens the existing crt.sh path, and gives slow techniques\ntheir own timeout budget.\n\nct_fingerprint (passive, no key, weight 0.70):\n- Backend A: kaeferjaeger.gay/sni-ip-ranges streaming download of\n five provider files (amazo\n[…]\n\nCoverage: pkg/techniques 83.9% (up from 82.4%), pkg/unearth 84.4%\n(up from 83.9%). No regression. e2e keyless run against example.com\nnow returns 62k candidates in 67s — meaningful free-tier results.",
"is_bot": false,
"headline": "Packet 5B: ct_fingerprint, crtsh hardening, per-technique timeouts",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T23:01:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f4001831d097f2839d5f816503ec4a1dc02834e9",
"body": "Adds five new techniques and the two-phase orchestration model they\nneed to be useful:\n\n- shodan_cert (active, 0.85) — TLS leaf-cert SHA-1 fingerprint\n pivoting via the Shodan /shodan/host/search endpoint, with the\n same tier_insufficient handling as censys_cert.\n- host_header (active, 0.85, consu\n[…]\nmat) while\ncensys_cert keeps SHA-256 — both share one dial via leafCertDER.\n\nCoverage: every new technique file ≥ 76%; package totals climb to\ntechniques 82.4%, unearth 83.9%; no regression elsewhere.",
"is_bot": false,
"headline": "Packet 5A: active & aggressive techniques + phased engine",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T21:03:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d801c0f67ffb9591a8bfa879a078f3a59dccd565",
"body": null,
"is_bot": false,
"headline": "lint: gofmt tty.go after removal of unused type",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:23:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1999bb90488b3414d579605e548df0b4aec7aceb",
"body": null,
"is_bot": false,
"headline": "lint: rename shadowing 'cap', drop unused discardTTY",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:22:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c2e87a489daa5fa4b75b0211f015c58d9db44b3a",
"body": "Adds the real unearth CLI in cmd/unearth/internal/cli, replacing the\nstub. main.go is thin: it calls cli.Run with os streams and exits with\nthe returned code. The package implements:\n\n- Root command running discovery on a single target, a -l <file>, or\n piped stdin (precedence in that order; ignore\n[…]\nes\n unwind cleanly.\n\nAlso adds an optional WeightsPath field to unearth.Options so --weights\nthreads through to config.LoadWeights (small additive change to the\nlibrary API authorized by the packet).",
"is_bot": false,
"headline": "Packet 4 Part C: CLI with cobra, three output formats, cache subcommands",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:20:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4feb632dcb7860697a30e7236480526ecc37a0ff",
"body": "The Censys Search v2 API is disabled for Free accounts and is being\nsunsetted in 2026; the legacy ID+secret pair no longer authenticates\nagainst any endpoint we can call. Move censys_cert to the Censys\nPlatform API:\n\n- POST https://api.platform.censys.io/v3/global/search/query with\n CenQL body host\n[…]\nas missing.\n- Tests rewritten: Bearer header asserted, search body parsed and\n validated, multi-page pagination exercised, empty/missing-PAT/\n budget-exhausted/HTTP-error/malformed-JSON all covered.",
"is_bot": false,
"headline": "censys_cert: migrate to the Censys Platform API",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:13:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b9ceede28b39e642b1b0110b0ec93f90dc342a10",
"body": null,
"is_bot": false,
"headline": "lint: wrap remaining deferred Body.Close in errcheck-friendly closure",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:05:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75a8321837029037b0431311a524ece6129e0772",
"body": "Wrap deferred Close() calls in errcheck-friendly closures, rename the\n'cap' identifier that shadowed the builtin, suppress unused-parameter\nwarnings on test/handler arguments that genuinely are unused, add a\njustifying comment to the modernc.org/sqlite blank import, and convert\na switch-true into a tagged switch per staticcheck QF1002.",
"is_bot": false,
"headline": "lint: fix errcheck, revive, and staticcheck findings",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:04:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f48a2e0e4c47ef7418a93eab2909d6c87b4865c2",
"body": null,
"is_bot": false,
"headline": "ci: bump golangci-lint-action to v7 for v2 support",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:00:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d3fe7a4d5f2a3ceb3d6a717c77d1c39b405aaef4",
"body": "Adds:\n- pkg/cdn: Cloudflare + CloudFront detection (DNS, headers, IP range\n match) with embedded range snapshots (2026-05-16) and a Refresh()\n hook for fetching fresh ranges.\n- internal/httpclient: shared HTTP client with tuned timeouts, redirect\n cap, TLS config, and User-Agent stamping.\n- Five \n[…]\ne.com, surfaces 2\n crt.sh candidates).\n\nCoverage: cdn 87.3%, techniques 78.3%, unearth 83.2%, httpclient 100%,\ncache 86.2%, config 92.9%, ratelimit 96.2%. CGO_ENABLED=0 builds\nclean. Race tests pass.",
"is_bot": false,
"headline": "Packet 3: passive techniques, CDN detection, orchestration engine",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T12:35:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f6e86ad05bbe021671927563c4d85a85aa6bba0b",
"body": "Bump Go floor from 1.22 to 1.23 in go.mod and README (dep graph requires\nit), pin CI Go to 1.23 on test/vet/lint, keep build matrix on stable.\nMigrate .golangci.yml to v2 schema (file shipped with Packet 3) and bump\nCI lint pin to golangci-lint v2.12.2.",
"is_bot": false,
"headline": "Packet 3 prep: Go floor and lint config",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T12:15:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a9f1ae86c9be10a3c3b268149594bc7a126da59",
"body": "Implements pkg/config (YAML weights w/ embedded defaults + XDG override,\nAPI key loading from env, credential status helper), pkg/cache (pure-Go\nmodernc.org/sqlite with WAL, deterministic Key(), TTL eviction, Purge,\nStats) and internal/ratelimit (per-key x/time/rate token buckets and a\nconcurrent-safe Budget for paid-API caps). All three satisfy the\ninterfaces declared in pkg/techniques. Coverage: config 92.9%, cache\n86.2%, ratelimit 96.2%. Builds clean with CGO_ENABLED=0; race tests pass.",
"is_bot": false,
"headline": "Packet 2: config loader, SQLite cache, rate limiter & budget",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T10:18:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7c8213f940c6c9cf0e4a519ec057ccc9cce7188a",
"body": null,
"is_bot": false,
"headline": "Initial scaffold: project structure, core types, ranking engine",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T06:54:20Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 2,
"commits_last_year": 70,
"latest_release_at": "2026-07-15T08:30:11Z",
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_last_push": 10,
"active_weeks_last_year": 5,
"days_since_latest_release": 10,
"mean_days_between_releases": 58.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": []
},
"popularity": {
"forks": 1,
"stars": 6,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-07-08",
"count": 1
}
],
"complete": true,
"collected": 1,
"total_forks": 1
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 50908,
"source_files_sampled": 111,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/mark3labs/mcp-go",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.48.0"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "golang.org/x/time",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.5.0"
},
{
"name": "gopkg.in/yaml.v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.0.1"
},
{
"name": "modernc.org/sqlite",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.30.2"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 45,
"open_issues": 1,
"closed_ratio": 0,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "bugsyhewitt",
"commits": 70,
"avatar_url": "https://avatars.githubusercontent.com/u/281210152?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"release.yml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 26 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "c0c546ca5dc5433cba621e35ef0e3b694b5164b3",
"ran_at": "2026-07-26T02:38:57Z",
"aggregate_score": 3,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-15T23:53:56Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-15T22:36:50Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 35,
"created_at": "2026-07-03T02:32:19Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/bugsyhewitt/unearth",
"host": "github.com",
"name": "unearth",
"owner": "bugsyhewitt"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 45,
"inputs": {
"security": 30,
"vitality": 63,
"community": 29,
"governance": 28,
"engineering": 72
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 63,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "at_risk",
"name": "Development activity",
"note": null,
"notes": [],
"value": 49,
"inputs": {
"commits_last_year": 70,
"human_commit_share": 1,
"days_since_last_push": 10,
"active_weeks_last_year": 5
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 10 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "5/52 weeks with commits",
"points": 3.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 5
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "70 commits in the last year",
"points": 16.6,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 70
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "good",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 83,
"inputs": {
"releases_count": 2,
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_latest_release": 10,
"mean_days_between_releases": 58.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "2 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 2
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 10 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~58.2 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 58.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 29,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 11,
"inputs": {
"forks": 1,
"stars": 6,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "6 stars",
"points": 11.3,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 6
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "1 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 1
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "critical",
"name": "Sustainability & Governance",
"value": 28,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "at_risk",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 38,
"inputs": {
"merged_prs": 45,
"open_issues": 1,
"closed_issues": 0,
"issue_closed_ratio": 0,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "0% of issues closed",
"points": 0,
"status": "missed",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 0
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "45/45 decided PRs merged",
"points": 38.2,
"status": "met",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 45,
"decided": 45
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 40,
"inputs": {
"followers": 24,
"owner_type": "User",
"is_verified": null,
"owner_login": "bugsyhewitt",
"public_repos": 40,
"account_age_days": 84
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "24 followers of bugsyhewitt",
"points": 10.1,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 24,
"login": "bugsyhewitt"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "40 public repos, account ~0 yr old",
"points": 12.2,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 40
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 72,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 6.4,
"status": "met",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 26 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 30,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": null,
"notes": [],
"value": 30,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 18,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 0,
"scorecard_aggregate": 3
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 26 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 70,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.929,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "65 of 70 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 65,
"sampled": 70
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 82,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0.514,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "36 of the last 70 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 36,
"sampled": 70
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 50908,
"source_files_sampled": 111,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/111 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 111,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"Could not fetch go package 'github.com/unearth-tool/unearth' from its registry",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-26T02:39:14.320787Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/b/bugsyhewitt/unearth.svg",
"full_name": "bugsyhewitt/unearth",
"license_state": "standard",
"license_spdx": "MIT"
}Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
Wie ein einzelnes Ergebnis im Gesamtregister steht: aggregierte Statistiken.