kanywst / brtc

Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [
        "argon2",
        "bcrypt",
        "brute-force",
        "bubbletea",
        "cli",
        "cost-calculator",
        "devsecops",
        "entropy",
        "go",
        "password-cracking",
        "password-strength",
        "sarif",
        "security",
        "tui",
        "zxcvbn"
      ],
      "is_fork": false,
      "size_kb": 5128,
      "has_wiki": false,
      "homepage": "https://pkg.go.dev/github.com/kanywst/brtc",
      "languages": {
        "Go": 98997,
        "Makefile": 331
      },
      "pushed_at": "2026-07-20T01:57:28Z",
      "created_at": "2026-03-08T05:06:44Z",
      "owner_type": "User",
      "updated_at": "2026-07-20T01:57:32Z",
      "description": "Cost calculator for offline password brute-force attacks: time + USD per GPU profile, with a CI gatekeeper.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": "https://kanywst.github.io/",
      "name": "kt",
      "type": "User",
      "login": "kanywst",
      "company": null,
      "location": null,
      "followers": 8,
      "avatar_url": "https://avatars.githubusercontent.com/u/45947799?v=4",
      "created_at": "2018-12-17T17:39:10Z",
      "is_verified": null,
      "public_repos": 42,
      "account_age_days": 2778
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v1.3.0",
          "kind": "minor",
          "published_at": "2026-07-19T13:28:26Z"
        },
        {
          "tag": "v1.2.0",
          "kind": "minor",
          "published_at": "2026-06-24T13:40:45Z"
        },
        {
          "tag": "v1.1.0",
          "kind": "minor",
          "published_at": "2026-05-05T07:21:13Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2026-03-08T06:31:40Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "245794bbdab261d3d40a9b12d15315fd41bc91b0",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-20T01:57:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7c621ac323a8502b44cb869dc74b360c1d08f970",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/v6...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-go\n  dependency-version: '7'\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "ci(deps): bump actions/setup-go from 6 to 7",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-20T01:55:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c409b000b36db707270a904e164f1a2a73a44118",
          "body": "Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.22 to 0.0.23.\n- [Commits](https://github.com/mattn/go-isatty/compare/v0.0.22...v0.0.23)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/mattn/go-isatty\n  dependency-version: 0.0.23\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-20T01:55:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea52f12745f46c0a146436bd4e53fa506a0b3f86",
          "body": "The release job archives LICENSE and README.md via .goreleaser.yml, but\nno LICENSE file existed, so GoReleaser failed globbing for it. README and\nthe nfpm config already declare MIT; add the matching license text.",
          "is_bot": false,
          "headline": "chore: add MIT LICENSE file",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:21:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d4be1d0950b601776bb1f26085d9b67aaf87c696",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-07-19T13:17:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1ee08d0d7d00fc6150d455cb4ba6ff5635a3088f",
          "body": "NaN fails every ordered comparison, so an uncomputable crack time slid\ninto the green RESISTANT verdict and a 'NaN years' duration:\n\n- renderVerdict flags NaN as 'VERDICT: UNKNOWN' (critical) instead of\n  falling through to the safe default.\n- FormatDuration maps NaN to the worst-case 'Less than a second' rather\n  than 'NaN years'.\n- addThousands preserves a leading sign so a negative never becomes\n  '-,123,456' (defensive; no caller passes negatives today).",
          "is_bot": false,
          "headline": "fix(ui): treat NaN durations as unsafe, not RESISTANT",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f5b2b96d06da580c9ab69ebb98053e5acb9ab82c",
          "body": "Cap the connection-reuse drain at 1 MiB so a malicious or oversized\nresponse cannot pin the reading goroutine on an unbounded stream. A real\nrange response is only tens of KB.",
          "is_bot": false,
          "headline": "fix(hibp): bound the body-drain read with a LimitReader",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aed801c04aeb7f3e81d362396f555fb53ae3f483",
          "body": "zxcvbn's pattern matching is super-linear on very long or highly\nrepetitive inputs, so an attacker-supplied megabyte string could pin a\nCPU. Truncate to 256 runes (rune-safe, never splitting a multi-byte\ncharacter) before analysis; anything longer is already unguessable, so\nno signal is lost.",
          "is_bot": false,
          "headline": "fix(zxcvbn): cap input length to bound analysis cost",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bd43b75c4b257ca8e90d94ce5f42e3694de4c8cb",
          "body": "- --hibp combined with --all-hw was silently dropped; reject it like the\n  other single-profile flags, per the stated no-silent-drop principle.\n- A known-breached password now fails the --fail-under-time gate\n  unconditionally, aligning the exit code with the COMPROMISED verdict.\n- Add cmd-level tests covering the flag-interaction guards.",
          "is_bot": false,
          "headline": "feat(cli): reject --hibp with --all-hw and fail the gate on a breach",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "db9355f110a823608ccddb360e0593c583587ae2",
          "body": "Construct the default http.Client once instead of per Check call so the\ntransport can pool connections, and drain any unread response body\nbefore closing (countInBody returns early on a match) so the connection\nis reusable rather than dropped.",
          "is_bot": false,
          "headline": "perf(hibp): reuse a package-level client and drain the body",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b0934ecaa57394d2725f3ca9f1afdeec0d01c1f7",
          "body": "…ounts\n\nAn astronomically long password overflows crack time to +Inf, which\npoisoned several output paths:\n\n- TotalCost now returns 0 for owned hardware instead of Inf*0 = NaN,\n  which had rendered as $NaN and broke JSON marshaling.\n- FormatCost guards NaN (-> $0.00); MarshalJSON sanitizes +Inf/NaN\n\n[…]\nt every comparison and int(NaN) panicked strings.Repeat.\n\nAlso add FormatCount so breach counts print as exact integers with\nseparators (9,659,365) rather than a lossy humanScale (9.7 million /\n42.0).",
          "is_bot": false,
          "headline": "fix(ui): harden output against non-finite floats and integer breach c…",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c919935afdbd4c400db4d9e87489b0e67052de4b",
          "body": "Address the Gemini review findings:\n\n- guessesToBigInt now maps a +Inf zxcvbn guess count to a 2^1024\n  sentinel instead of letting big.Float.Int(nil) collapse it to 0,\n  which had inverted an unguessable password into \"instantly\n  crackable\". NaN / non-positive clamp to 0. Extracted as a pure\n  hel\n[…]\n unit-tested.\n- countInBody returns a scan error instead of swallowing it, and\n  Check propagates it, so a truncated response body no longer reports\n  a breached password as \"not found in the corpus\".",
          "is_bot": false,
          "headline": "fix(review): handle zxcvbn +Inf and propagate HIBP scan errors",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "dd2414c1a8bfed6fffca4dd0173c397b78c75bea",
          "body": "Refresh the pairing section for the built-in --zxcvbn analyzer and the\n--hibp breach check, add the AI-GPU cost-inefficiency note to the\nall-hw example (with current numbers), and mention the verdict banner\nand entropy gauge in Features.",
          "is_bot": false,
          "headline": "docs(readme): document 2026 refresh, --zxcvbn, --hibp, and new UX",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "228fd177af3416916d3d94a1d9efb74124c12bbc",
          "body": "Add a --hibp flag and an internal/breach package that queries HIBP via\nthe k-anonymity range API: only the first 5 hex chars of the password's\nSHA-1 are sent, and the suffix is matched locally, so the plaintext\nnever leaves the machine. The lookup is opt-in and network failures are\nwarnings, not fat\n[…]\nt.\n\nA breached password overrides the verdict banner to COMPROMISED\nregardless of entropy (the attacker looks it up rather than cracking\nit), and the count surfaces in the TUI, table, and JSON output.",
          "is_bot": false,
          "headline": "feat(hibp): add opt-in Have I Been Pwned breach check",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8ef767c45d8919baf434f2c37183b40d911dba31",
          "body": "Add a --zxcvbn flag that runs Dropbox's zxcvbn (trustelem/zxcvbn port)\nover the password and feeds its guess count through the existing\nFromGuesses pipeline, instead of the naive R^L entropy. This closes the\ntool's headline gap: naive entropy rates \"P@ssw0rd!\" at ~1.6M years,\nwhile zxcvbn correctly \n[…]\ns crackable in under a second.\n\n--zxcvbn and --guesses are mutually exclusive; budget/recommendation\nmath (which needs a charset) is skipped for both external estimates via\na shared haveCharset guard.",
          "is_bot": false,
          "headline": "feat(zxcvbn): add built-in pattern-aware strength estimation",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ded2c3dac1c60f2dd6599c39f5b5af63899accb0",
          "body": "NIST SP 800-63B-4 (2025) de-emphasizes character-space entropy for\nhuman-chosen passwords. Add EntropyModelNote so every output surface\n(TUI footnote, table trailer, and a new entropy_model JSON field)\nstates that the default figure is an R^L brute-force upper bound\nassuming a random password, and points at the pattern-aware --guesses\npath; the note switches wording when an external guess count is used.",
          "is_bot": false,
          "headline": "feat(ui): label entropy as a random-password upper bound",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aa1c17c080d3f7835a6df36cecef69e414954678",
          "body": "Replace raw digit walls with legible formatting across the TUI, table,\nand matrix views:\n\n- FormatDuration collapses huge year counts to short-scale words and\n  anchors anything past ~13.8Gyr against the age of the universe, so\n  \"2414613469377.2 years\" becomes \"1.3 trillion years (95x ...)\".\n- Form\n[…]\nillion), and \"< $0.01\" so a\n  trivially cheap crack no longer reads as free ($0.00).\n- The TUI gains a one-line coloured VERDICT headline and an entropy\n  gauge bar so strength is legible at a glance.",
          "is_bot": false,
          "headline": "feat(ui): humanize numbers and add a verdict banner + entropy gauge",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c1d6a6cc85373fd1081d3f400307e3371e135850",
          "body": "Add RTX 5090 (Blackwell) and RX 7900 XTX profiles, add sha1/ntlm\nhashrates to every profile, and correct several stale figures:\n\n- rtx-4090 bcrypt cost-5 was ~1.8x too slow (100k -> 184k H/s).\n- aws-p5.48xlarge (8x H100) was ~4x overstated; AI datacenter GPUs\n  are poor crackers (integer/bitwise, no\n[…]\nx-4090 rental bumped to $0.35/hr per 2026 marketplace pricing.\n\nExpose sha1/ntlm via --algo and the two new profiles via --hw. Update\nREADME, CLAUDE.md gotchas, and the completeness tests accordingly.",
          "is_bot": false,
          "headline": "feat(data): refresh hardware baselines to 2026 hashcat numbers",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-07-19T13:15:58Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "588f1e8b4b39c3fe5cea355956e46146d9875846",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-29T13:43:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "798f838d89e6afc60132e2108b018bfbb18ffa9d",
          "body": "Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.20 to 0.0.22.\n- [Commits](https://github.com/mattn/go-isatty/compare/v0.0.20...v0.0.22)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/mattn/go-isatty\n  dependency-version: 0.0.22\n  dependency-type: direct:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.22",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-29T13:40:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0bd4ae99f32901619678fa29c2c58b01eae7754a",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-24T10:03:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "25b9513d03f71958223883d8788dbd9c8754e8b5",
          "body": "The clamp test only checked for a negative result, so it would have passed on\nany non-negative value; assert == 0 to actually verify the clamp.",
          "is_bot": false,
          "headline": "test(budget): assert tiny-budget length is exactly 0",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T10:01:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "110b88dc6ba84a2c3ad5c9f9c8acaa54c9c6130f",
          "body": "An astronomically large budget overflowed the 2*T*H product to +Inf, making\nthe int cast garbage. Sum the logarithms instead so the result stays finite.",
          "is_bot": false,
          "headline": "fix(budget): compute max length via log sum to avoid float overflow",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T10:01:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "48c8633827218ebdef89bb76dfabe11cd3021d2f",
          "body": "A budget too small to afford even one character produced a negative floor,\nwhich leaked a negative budget_max_chars into JSON. Clamp the result to 0.",
          "is_bot": false,
          "headline": "fix(budget): clamp MaxLengthForBudget to non-negative",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T10:01:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cc4c554d14b3a4b419a2f6edf1e2d32659548a5a",
          "body": "Rebase onto main brought in the table format (#19); update its budget block to\nthe *int BudgetMaxChars type and BudgetUnlimited flag, and add the recommended\nlength row for parity with the TUI.",
          "is_bot": false,
          "headline": "fix(output): handle *int BudgetMaxChars and unlimited in table renderer",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T10:01:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d5a9ea20164591d429459bc7fa94f6daf2fbef26",
          "body": "A small sentinel (999) could in theory equal a genuinely computed budget\nlength, which would then be misreported as unlimited. Use math.MaxInt, which\nthe log-based calculation can never produce.",
          "is_bot": false,
          "headline": "fix(budget): make unlimited sentinel non-colliding (math.MaxInt)",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T10:01:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d895ab5f00c39384d700e875d49729096afab0e7",
          "body": "…ncalculated\n\nA calculated 0 ('cannot resist even a 1-char password') is meaningful and\ndistinct from 'not calculated' (--guesses, or no --budget). With a plain int +\nomitempty the two collapsed, and the TUI wrongly printed '0 (Cannot resist)'\nfor an uncalculated value. Make it *int: nil omits the JSON field and the TUI\nrow; a calculated value (including 0) is shown.",
          "is_bot": false,
          "headline": "refactor(budget): use *int for BudgetMaxChars to distinguish 0 from u…",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T10:01:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "de4c50f902a0ee6eac85dff0a39ad31637430b53",
          "body": "MaxLengthForBudget returns 999 as an infinity sentinel for owned hardware\n(no rental cost). That number leaked into the output verbatim: the TUI showed\n\"999 chars (Within budget)\" and JSON emitted budget_max_chars: 999, both read\nas a literal length. Name the sentinel (cost.UnlimitedBudgetChars), surface it\nas a BudgetUnlimited flag, render it as \"∞ (owned hardware — no rental cost)\"\nin the TUI, and omit the bogus length from JSON.",
          "is_bot": false,
          "headline": "fix(budget): represent owned-hardware budget as unlimited, not 999",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T10:01:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ef0e1cb7a8eb7fd35485d0d53ca60b6469d1c4b6",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-24T10:00:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "691203e5e0f7b449e5f1deef6669b3dfa0f01c11",
          "body": "Move the unsupported-format check into the up-front guard so it fails fast\nwithout running the full per-profile computation.",
          "is_bot": false,
          "headline": "refactor(cli): reject sarif with --all-hw before building the matrix",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:58:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5e4f59f28707891fa9cd35df46df65373346bf43",
          "body": "--all-hw compares every profile, so a single --hw selection is meaningless;\nerror rather than silently ignore it, consistent with the other guards.",
          "is_bot": false,
          "headline": "fix(cli): reject --hw combined with --all-hw",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:58:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f53cb0f76abe156db8c504bfb2dbbcf85f1b9542",
          "body": "Make buildMatrix a pure function of its arguments instead of reading the\npackage-level flag globals, matching how memoryMB is already passed.",
          "is_bot": false,
          "headline": "refactor(cli): pass algo and workFactor into buildMatrix",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:58:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1d6baa701be2c93aac7e274db337cd237ef236f3",
          "body": "…them\n\nSilently dropping --fail-under-time under --all-hw would bypass a CI security\ngate, and emitting a table for -o sarif breaks downstream parsers. Return a\nclear error for --budget, --fail-under-time, and sarif when combined with\n--all-hw. Also route matrix JSON through a testable io.Writer helper.",
          "is_bot": false,
          "headline": "fix(cli): reject conflicting flags with --all-hw instead of ignoring …",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:58:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0e8d6374da0fe6420ac12fa95742f4b949bd49c6",
          "body": "Build the matrix body once and write it with a checked io.WriteString instead\nof unchecked fmt.Fprintf calls into the tabwriter.",
          "is_bot": false,
          "headline": "fix(lint): check write error in matrix renderer (errcheck)",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:58:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ae65f70505470e31ffcd7a7d3cda3ae71175e772",
          "body": "Runs the password against every profile in one shot and prints a matrix sorted\nfastest-attacker-first (Raspberry Pi to 8x H100), with owned hardware shown as\n\"owned\" instead of a rental cost. Supports -o json for an array. This is the\nclearest way to show how hardware scales the threat. It is a standalone\ncomparison view, so --budget and --fail-under-time (single-profile concepts)\nare not combined with it.",
          "is_bot": false,
          "headline": "feat(cli): add --all-hw to compare across every hardware profile",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:58:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fb6e2c9223e8200eee914f8282479e10f13db099",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-24T09:49:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7be213c9614af9d5905a3379e19b03589f54e478",
          "body": "When installed via 'go install .../brtc@vX', ldflags are not applied, so the\nversion stayed 'dev'. getVersion() reads the module version from build info as\na fallback so installed binaries report their tag.",
          "is_bot": false,
          "headline": "feat(cli): fall back to build-info version for go install",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:48:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "93e5dc126c58187555fd2537447236b28977a3f1",
          "body": "nil makes cobra fall back to os.Args (the go test flags) on a later Execute.",
          "is_bot": false,
          "headline": "test(cli): use empty args slice in --version test cleanup",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:48:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bc984a8ba6dfba071f1cfe81f926769a2b5880b2",
          "body": null,
          "is_bot": false,
          "headline": "test(cli): reset command output writer in --version test cleanup",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:48:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c50b3f0c3cf1aef8f1726c8aee546aaaa3b3b89d",
          "body": "The release pipeline ships tagged binaries via goreleaser, but the binary had\nno way to report its own version. Wire cobra's Version field to a package var\ndefaulting to \"dev\" and inject the real value at release time via -ldflags.",
          "is_bot": false,
          "headline": "feat(cli): add --version flag",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:48:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bdfb57519c8128729728f4a78c5977cb69d961b7",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-24T09:46:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f34a914e56b046f63dd7bb69c3be5f130fadb7d2",
          "body": null,
          "is_bot": false,
          "headline": "fix(cli): include table in unknown-format error message",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c375d10cce972c3da7839979a1992b54716f64cb",
          "body": "…o TUI\n\nA misspelled -o value (e.g. 'jsn') silently rendered the TUI, which is\nconfusing in scripts and CI. Reject unrecognized formats with a clear error.",
          "is_bot": false,
          "headline": "fix(cli): error on an unknown output format instead of falling back t…",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "52741cc2d82feafae42c7c6a5256ec6882c4339e",
          "body": "isatty.IsTerminal reports false for MSYS/Git Bash terminals on Windows;\nalso check IsCygwinTerminal so the interactive TUI is not downgraded to JSON\nin those shells.",
          "is_bot": false,
          "headline": "fix(cli): detect Cygwin/MSYS terminals for TTY check",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5e6c522cdb302fc344d6960ee7d6ab461144f874",
          "body": "The default output format is the TUI. When stdout was piped or redirected,\nbrtc still ran the Bubble Tea program, emitting escape codes into the pipe (or\nfailing outright in CI). Detect a non-terminal stdout and, unless the user set\n-o explicitly, downgrade the default tui to json so 'brtc pw | jq' just works.",
          "is_bot": false,
          "headline": "fix(cli): fall back to JSON output when stdout is not a terminal",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "177f62b537a5f828cab4913178974b1ee8727c17",
          "body": "Absent combinations now leaves the field untouched (stdlib merge semantics)\nwhile an explicit null clears it; the quoted string form is decoded with\nstrconv.Unquote instead of a naive Trim.",
          "is_bot": false,
          "headline": "fix(json): distinguish absent from null and unquote robustly",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f2bbe132b028694a7132fcb1612720dad5068929",
          "body": "UnmarshalJSON returned early on null without resetting the field, so decoding\na null over a struct that already held a value left it stale. Set it to nil.",
          "is_bot": false,
          "headline": "fix(json): clear combinations when payload is null",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1e94f88a3c6b4299a1702394acfe3c9710277c80",
          "body": "Address review: marshal a nil Combinations as JSON null instead of \"0\", and\nmake UnmarshalJSON accept both the new string form and the legacy bare-number\nform (plus null) via json.RawMessage, so old payloads still decode.",
          "is_bot": false,
          "headline": "fix(json): preserve null combinations and accept legacy number form",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5f1658ee75af27c055c31065ca4edbd74c5544de",
          "body": "R^L is emitted as the JSON 'combinations' field. As a bare JSON number it\noverflows IEEE-754 doubles (even a 9-char password exceeds 2^53, and long\npasswords produce hundred-digit values), so JavaScript and many other parsers\nsilently truncate it. Marshal it as a string, with a matching UnmarshalJSON so\nthe format still round-trips.",
          "is_bot": false,
          "headline": "fix(json): emit combinations as a string to preserve precision",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6ae292231d59755a42079ee1b6c5fd9f7fb46b31",
          "body": "…solve\n\nlookupProfile lowercased but did not trim, while ResolveProfileName trimmed;\nextract normalizeProfileKey so both agree (whitespace + case) and a padded\n--hw value resolves consistently.",
          "is_bot": false,
          "headline": "refactor(cost): share profile-key normalization between lookup and re…",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "76c3a6b788d87f9a9f9a161d763e6d30f241e1a6",
          "body": "Use cobra's error writer instead of os.Stderr directly so the warning honours\nany custom writer set on the command (e.g. in tests or when embedded).",
          "is_bot": false,
          "headline": "refactor(cli): emit unknown-hw warning via cmd.PrintErrf",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "26e6b81330fc6ebf5ad335b6715087d409441883",
          "body": "An unknown --hw value silently falls back to rtx-4090, but the results\nstill echoed the bogus input as the hardware profile, so the numbers\ndescribed a different (much faster) GPU than the label claimed. Resolve the\nprofile name up front, print a stderr warning when it falls back, and emit\nthe canonical profile name in the output.",
          "is_bot": false,
          "headline": "fix(cli): warn and report resolved profile on unknown --hw",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0c2a358a977c35c814ae9e6625764203ff148bbd",
          "body": null,
          "is_bot": false,
          "headline": "test(cli): reset flag-bound budget global between tests",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c4031e69c1553cb2a2cc7085861c8144ca35a969",
          "body": "Reset SilenceUsage (mutated by RunE) and use an empty args slice instead of\nnil, which would otherwise make cobra fall back to os.Args (the go test flags)\non a later Execute.",
          "is_bot": false,
          "headline": "test(cli): fully reset shared rootCmd state in cleanup",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "99ca30379f6b0bb2949be86f15d51251c738c109",
          "body": "…errors\n\nMove SilenceUsage into RunE so genuine argument-parsing errors (unknown flag,\ntoo many args) still show the usage block, while runtime failures from RunE do\nnot. Reset the command's writers in the test cleanup to avoid cross-test state.",
          "is_bot": false,
          "headline": "refactor(cli): keep usage for arg-parse errors, silence only runtime …",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ef9023f3df6918c577f09a647b892619d882ee9a",
          "body": "…lures\n\nRuntime errors from RunE (e.g. an invalid --budget) previously printed the\nfull flag usage block and the error string twice: once by cobra and once by\nmain(). Set SilenceUsage/SilenceErrors so main() prints the error a single\ntime and usage is reserved for actual argument-parsing help.",
          "is_bot": false,
          "headline": "fix(cli): silence cobra usage dump and duplicate error on runtime fai…",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-24T09:44:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3b8ab78ff7ff629c5c0fc2d17ba3c4ee25c33a52",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-23T14:54:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b31a1f9017926f6ada094b3bcb042e8595d3139e",
          "body": "The recommend-length test (#21) referenced model.loaded, but the field was\nremoved when the TUI dropped Bubble Tea (#16). Both merged, leaving main\nuncompilable. Use initialModel(data).View() to match the current model.",
          "is_bot": false,
          "headline": "fix(ui): repair broken test after Bubble Tea removal",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-23T14:53:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "699954cf58871251922b5768a1066cef5d0c4e26",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-23T14:13:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c13ee1225ffe08f1783943c75363943dc5ca3587",
          "body": "An extreme --fail-under-time threshold can overflow the intermediate product\nto +Inf, making the computed length Inf/NaN; converting that to int yields a\nnegative value that wrongly surfaced as a 1-char recommendation. Cap the result\nat a sentinel (999) so an impossible requirement never recommends a trivially\nshort password.",
          "is_bot": false,
          "headline": "fix(cost): clamp MinLengthForTime on float overflow",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-23T14:11:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "233c83d034136758e5123afa960fd4b8f01db69f",
          "body": "A --fail-under-time gate tells you a password failed but not what to do about\nit. Invert the time formula (cost.MinLengthForTime) to report the minimum\nlength over the same charset that would survive the threshold on the chosen\nhardware. Surfaced as 'Recommended Len' in the TUI (green once the current\npassword already meets it) and 'recommended_chars' in JSON. The threshold is\nnow parsed once, before output, and reused by the gatekeeper.",
          "is_bot": false,
          "headline": "feat(cli): recommend the minimum safe length for --fail-under-time",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-23T14:11:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "284df5cb6b18565b116d801d2b477feb85154133",
          "body": "Avoid a nil pointer dereference if PrintTable is called with a zero-value\nOutputData; fall back to \"0\" like the other renderers.",
          "is_bot": false,
          "headline": "fix(output): guard against nil Combinations in table renderer",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-23T14:11:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "398d04367721ec45207a8023a6c6629169d55275",
          "body": "Build the table body once and write it with a checked io.WriteString instead\nof unchecked fmt.Fprintf calls into the tabwriter.",
          "is_bot": false,
          "headline": "fix(lint): check write error in table renderer (errcheck)",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-23T14:11:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0e3d38df618446436e76b787fc327d3ceb3f2b2a",
          "body": "Adds a colour-free, ANSI-free aligned table format alongside tui/json/sarif.\nUseful for piping, pasting into docs, or terminals where the TUI is noise but\nJSON is overkill. Reuses FormatDuration and is rendered through an io.Writer\nso it can be unit-tested without capturing stdout.",
          "is_bot": false,
          "headline": "feat(output): add -o table plain-text output",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-23T14:11:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "702d134ff4e798b10a385bc8a9c9d63979cd44ab",
          "body": "…atives\n\nReplace the manual string slicing in formatCombinations with big.Float and\n%.3e: it rounds instead of truncating and handles negative inputs, per review.",
          "is_bot": false,
          "headline": "refactor(tui): format combinations via big.Float for rounding and neg…",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-23T14:10:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d528687617f5a9cc4e2827458546e8a248b9d292",
          "body": "R^L for a long password is hundreds of digits; printed verbatim it blew the\nbounded TUI box apart. Render combination counts exactly up to 21 digits and\nfall back to scientific notation (e.g. the ~395-digit 94^200 becomes\n4.222e394) beyond that.",
          "is_bot": false,
          "headline": "fix(tui): show huge combination counts in scientific notation",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-23T14:10:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3124fc732de809b1dadd4c00286d49239547c8d9",
          "body": "The view is fully determined before render and the program quit immediately\nafter the first frame, so the Bubble Tea event loop was dead weight (and its\nUpdate key handling was unreachable). Print the Lipgloss render straight to\nstdout: simpler, no terminal required (so piped -o tui no longer errors), and\ndrops the bubbletea dependency.",
          "is_bot": false,
          "headline": "refactor(tui): print the result directly instead of via Bubble Tea",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-23T14:10:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d5b9b1aa6cfe420c42fe15c797c1b56ac42cf04c",
          "body": "The TUI batched a spinner with a hard-coded 500ms time.Sleep 'for effect'\nbefore revealing results that were already fully computed before the program\neven started. That is latency the user pays on every run for a fake animation.\nRender the result immediately and quit; this also removes the now-unused\nspinner and the bubbles dependency.",
          "is_bot": false,
          "headline": "fix(tui): drop the artificial 500ms loading delay",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-06-23T14:10:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ef5bd49cc432c50cd732d49efd760ddef056603c",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-06-22T10:16:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "baca370c37aa5f0936689457d8d4a9fa77ff1953",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v6...v7)\n\n---\nupdated-dependenc\n[…]\n:\n- dependency-name: actions/checkout\n  dependency-version: '7'\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "ci(deps): bump actions/checkout from 6 to 7",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-22T10:15:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fb0b23f91791d3938fa867150752ca795389683d",
          "body": "- Cross-compile darwin/linux × amd64/arm64\n- Publish Homebrew cask to kanywst/homebrew-tap on tag\n- Generate CycloneDX SBOMs with syft per archive\n- Sign checksums with cosign (keyless, Sigstore via GitHub OIDC)\n\nReleasing requires HOMEBREW_TAP_GITHUB_TOKEN secret (PAT with contents:write\non kanywst/homebrew-tap).",
          "is_bot": false,
          "headline": "feat(release): add goreleaser config and release workflow",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-27T14:12:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d1c0fe725fb95e84ce5711a0cfc5105b23b1462a",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-05-11T03:12:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "beb716e6f95f4124358433c5cc14171f2a9d344d",
          "body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/upload-artifact\n  dependency-version: '7'\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "ci(deps): bump actions/upload-artifact from 4 to 7",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-11T03:10:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cfbffa357c9372844f70b959ae29be5ff834c5ad",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-05-05T07:20:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "624d0042d26c38c2448b9de0ea5dc9075ec6bbc2",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5 to 6.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-go\n  dependency-version: '6'\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "ci(deps): bump actions/setup-go from 5 to 6",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-05T07:18:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0858908f1db8ce9430ab4ad204d3498b77a0795a",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v4...v6)\n\n---\nupdated-dependenc\n[…]\n:\n- dependency-name: actions/checkout\n  dependency-version: '6'\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "ci(deps): bump actions/checkout from 4 to 6",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-05T07:18:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "65cb2778eb000427ad90845bed8d75585bca4d7d",
          "body": "Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 7 to 9.\n- [Release notes](https://github.com/golangci/golangci-lint-action/releases)\n- [Commits](https://github.com/golangci/golangci-lint-action/compare/v7...v9)\n\n---\nupdated-dependencies:\n- dependency-name: golangci/golangci-lint-action\n  dependency-version: '9'\n  dependency-type: direct:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
          "is_bot": true,
          "headline": "ci(deps): bump golangci/golangci-lint-action from 7 to 9",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-05-05T07:18:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0344ad4f14ade75061a528998a01a45f4adebf96",
          "body": null,
          "is_bot": true,
          "headline": "chore(demo): regenerate VHS gif [skip ci]",
          "author_name": "github-actions[bot]",
          "author_login": "github-actions[bot]",
          "committed_at": "2026-05-05T07:13:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ae226f0635384b5cff6d30228accdb894dfe3bdd",
          "body": "big.ParseFloat happily accepts 'inf' / '+inf' / '-inf'. The\nsubsequent big.Float.Int(nil) on +Inf returns a nil *big.Int rather\nthan an error, and that nil value would then panic downstream in\nTimeToCrack via big.Float.SetInt(nil).\n\nAdds an explicit IsInf check after sign validation, plus tests for\n'inf' and '+inf'.",
          "is_bot": false,
          "headline": "fix(calc): reject infinite ParseGuesses input",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:12:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7075a376f68d52bf909ec48c36080f4c9bd2df47",
          "body": "Adds the two new flags to the options table, plus a worked example\nof the recommended brtc + zxcvbn combo (zxcvbn does pattern detection,\nbrtc converts the resulting guess count into time and USD), and an\nArgon2id memory-sweep example showing how memory hardens against GPU\nattackers.",
          "is_bot": false,
          "headline": "docs(readme): document --memory, --guesses, and zxcvbn pairing",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:12:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c54cb83a4eca2b3bf2afa09d95f53045ccac8c59",
          "body": "--memory accepts an Argon2id memory parameter (e.g. 64m, 128m, 1g)\nthat flows through CalculateHashRate and MaxLengthForBudget so\ndefenders running heavier memory settings see the corresponding cost\nbenefit.\n\n--guesses accepts an external guess count, typically the 'guesses'\nfield from a zxcvbn repo\n[…]\nand a log2 helper\nthat falls back to bit length so log2(huge *big.Int) does not blow\nup float64. MemoryMB is exposed on OutputData JSON via 'memory_mb'\n(omitempty) so JSON consumers see the parameter.",
          "is_bot": false,
          "headline": "feat(cli): add --memory and --guesses flags",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:12:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "64b9b4b0fda05d1ff213f1c9885514a6417dc900",
          "body": "Argon2id is a memory-hard function: its actual attacker throughput\ndepends almost as much on memory pressure as on time iterations. The\nprevious CalculateHashRate formula divided only by workFactor (t),\ntreating memory as a fixed baseline. That underestimated defender\nstrength for any policy that bu\n[…]\nears to\nspeed the attacker up.\n\nThis commit is just the signature/scaling change. All call sites pass\n0 (= use baseline), preserving the prior behavior. The next commit\nwires up the --memory CLI flag.",
          "is_bot": false,
          "headline": "feat(cost): accept argon2id memory parameter in hashrate scaling",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:12:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9b0a8a62a1df2d8d0b135e5b52d8795744c5f0d5",
          "body": "ParseMemory accepts the Argon2id memory parameter as 64m, 1g, or a\nbare integer (MB). KB intentionally omitted because Argon2id is\nnever configured below MB granularity.\n\nParseGuesses accepts the 'guesses' field from a zxcvbn report,\nincluding scientific notation (1.234e+10). Returns *big.Int because\nguess counts for long passwords routinely exceed int64.\n\nBoth helpers are wired up in the next commit.",
          "is_bot": false,
          "headline": "feat(calc): add ParseMemory and ParseGuesses helpers",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:12:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "80c0b57e82a0ba3a211da2ead2bb6898698cc590",
          "body": "VHS drives headless Chrome internally; on ubuntu-latest with the\ndefault Docker shm size (64MB), Chrome crashes with\n'chrome_crashpad_handler: --database is required' before any frame\nis captured. Sharing the host IPC namespace gives the container\nenough shared memory to render. Drops --user because the image's\nttyd/chrome bits expect the in-image user; ownership of the produced\ngif is fixed up via sudo chown after the run.",
          "is_bot": false,
          "headline": "ci(vhs): pass --ipc=host so Chrome inside the VHS image has enough shm",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:11:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "13da45d13d354b57d43b64170fbab3a59674c6a1",
          "body": "charmbracelet/vhs-action@v2 fails to install ffmpeg on the current\nubuntu-latest runner image (see the failed run on PR #5). The\nofficial ghcr.io/charmbracelet/vhs Docker image bundles ttyd,\nffmpeg, and fonts so the render step does not depend on apt or any\nnetwork install at action time.",
          "is_bot": false,
          "headline": "ci(vhs): switch to Docker image instead of vhs-action",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:11:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "81961c7609519e74f0b255e72414d3ff72b1c2c5",
          "body": "PR runs upload the rendered gif as an artifact (preview) without\nwrite permissions, so forked PRs don't try to push.\n\nPushes to main render the gif and auto-commit only if it actually\nchanged, with [skip ci] in the message to avoid loops. Triggered by\nchanges to demo.tape, Go sources, or the workflow itself.",
          "is_bot": false,
          "headline": "ci: add VHS workflow to render demo.gif on PR and main",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:11:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c6ef21c83eeb8d5b8bacbf79d7429733eaf76560",
          "body": "The previous demo.tape ran 'go build -o brtc' from inside VHS, which\nrequired a Go toolchain to be present in the VHS container — not the\ncase for charmbracelet/vhs-action. Caller (CI workflow or local user)\nnow builds the binary first; the tape only adjusts PATH.\n\nRegenerates assets/demo.gif from the new tape so the first CI run\nfinds it unchanged and skips the auto-commit.",
          "is_bot": false,
          "headline": "chore(demo): drop in-tape go build and regenerate gif",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:11:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "47ae3c8e03cbdfb44b5ef96dd09c4602797ca6ff",
          "body": "Adds a callout immediately under the title pointing readers at zxcvbn\nfor pattern detection. Raw entropy makes 'P@ssw0rd!' look strong, but\na real attacker with a dictionary cracks it in seconds. Setting the\nexpectation up front avoids misuse and prepares the ground for the\nupcoming --guesses flag that lets brtc consume zxcvbn output.",
          "is_bot": false,
          "headline": "docs: clarify brtc is a cost calculator, not a strength meter",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:11:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4f7e4fd7ed56ba7be043f566279b1d85e34cb2cd",
          "body": "Previously, when CalculateHashRate received an algorithm not present\nin the profile's Hashrates map, it picked up the raw bcrypt baseline\nbut then dropped into the default switch arm and returned that\nbaseline unchanged. With --cost 12, the attacker rate would be\nshown as the cost=5 baseline (32x to\n[…]\nt' before the switch so the\ncost-factor scaling applies. Also tightens the init() check to\nrequire a positive bcrypt hashrate on the fallback profile so the\nfallback path can never silently produce 0.",
          "is_bot": false,
          "headline": "fix(cost): apply bcrypt scaling when falling back from unknown algo",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:01:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "29be346ab74a262fba367755243239b7d3b87262",
          "body": "TestProfilesAreComplete walks every entry in the embedded YAML and\nfails CI if any profile is missing a display name, source URL/note,\nlast_reviewed date, or a positive hashrate for any of the algorithms\nthe CLI exposes via --algo. Catches half-filled YAML rows the next\ntime someone adds a profile or an algorithm.",
          "is_bot": false,
          "headline": "test(cost): require hashrate completeness and citation per profile",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:01:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "12f987edeae75ff6151fccc0728d138b8c171b4d",
          "body": "Hardware hashrate baselines used to live as hardcoded literals in a Go\nmap, which made two things hard:\n\n  1. Every refresh required a Go code change and a code review of the\n     numbers themselves, mixing data ownership and code ownership.\n  2. There was no place to record where each number came f\n[…]\nevery profile struct.\n\nCalculateHashRate / TotalCost are unchanged behaviorally; the unknown-\nprofile fallback is now a constant (fallbackProfile) instead of magic\n\"rtx-4090\" strings sprinkled around.",
          "is_bot": false,
          "headline": "refactor(cost): externalize hashrates to embedded YAML with citations",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T07:01:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b68850682ab1ecd989b6310dabf7abc2caa8bd28",
          "body": "Disable revive's exported and package-comments rules — they require\ngodoc-style WHAT comments on every exported symbol, which conflicts\nwith the repo policy of comments only when the WHY is non-obvious.\nOther revive checks stay on.\n\nAlso rewrites the !(large > small) assertion in cloud_test.go to\nthe equivalent large <= small per staticcheck QF1001.",
          "is_bot": false,
          "headline": "chore(lint): silence revive WHAT-only comment rules and fix de-Morgan",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T06:32:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9c96b9edb14bc100cae8f27efb691dae9a3b5067",
          "body": "Adds unit tests for the previously untested cost and ui packages:\n- bcrypt 2^(workFactor-5) scaling and the cost<5 clamp\n- argon2id linear scaling\n- ParseBudget tolerance for usd/$ suffixes and surrounding whitespace\n- MaxLengthForBudget owned-hardware sentinel and budget monotonicity\n- OutputData J\n[…]\nield\n- FormatDuration unit transitions\n\nAlso adds a guardrail test (TestProfilesContainAdvertisedNames) so any\nfuture drift between the --hw flag/README list and the Profiles map\nis caught at CI time.",
          "is_bot": false,
          "headline": "test: cover cost and ui helpers",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T06:32:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fa218a7b77a5357894a0fb1ca7e881de0002fad6",
          "body": "The fail-under-time parser was inline in cmd/root.go with no test\ncoverage. Pulling it into internal/calc/duration.go gives it a\nproper unit test for unit boundaries, trimming, case sensitivity,\nand rejected composite forms like 1h30m.",
          "is_bot": false,
          "headline": "refactor: move duration parser into calc package and add tests",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T06:32:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0331d825b7ee08852f5d15a236299150130bc8b7",
          "body": "os.Exit(1) inside RunTUI bypassed the cobra RunE return path, so the\n--fail-under-time gatekeeper logic and any caller-side cleanup never\nran. Wrapping the underlying error with %w lets callers Unwrap if\nthey want to distinguish render failures.",
          "is_bot": false,
          "headline": "fix(ui): propagate TUI errors instead of os.Exit",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T06:32:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "644f4aaac9674fdc1e8cb6323c63f9487dd0c991",
          "body": "Both profiles were already advertised in the --hw flag help and the\nREADME table but absent from the Profiles map, causing a silent\nfallback to rtx-4090. Hashrates are scaled from the existing mac-m3\nand cpu-standard baselines (M3 Max ~3x base M3 GPU cores, Pi 4 ~1/20\nof an 8-core x86 CPU).",
          "is_bot": false,
          "headline": "feat(cost): add mac-m3-max and raspberry-pi-4 hardware profiles",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T06:32:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "758f0dcd6fa50c6dbf5371f402da7d1cac799e17",
          "body": "Bumps the linter's parsed Go version from 1.24 to 1.25 to match go.mod\nand CI. Adds revive/unconvert/unused to catch low-effort issues, and\nmoves gofmt/goimports under the v2 formatters block so 'golangci-lint\nfmt' can replace ad-hoc 'go fmt' invocations.",
          "is_bot": false,
          "headline": "chore(lint): align go version with go.mod and enable formatters",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T06:32:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "15263eca109fe005401d7118a6f2f2e81654bafc",
          "body": "Weekly Monday 09:00 JST. Charm and cobra ecosystems are grouped so\nrelated bumps land in a single PR.",
          "is_bot": false,
          "headline": "ci: add dependabot for gomod and github-actions",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T06:32:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "06bb4d8c2adc62f0e85f3da9ee4ecf6f1cb1699f",
          "body": "Build artifacts, test output, IDE/OS metadata, and local Claude Code\nstate should not be checked in. The compiled brtc binary was 5.2 MB\nand would drift from source on every release.",
          "is_bot": false,
          "headline": "chore: untrack brtc binary and add .gitignore",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-05-05T06:32:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4f08013eb66238b2a9461bdee067fe188a73722e",
          "body": null,
          "is_bot": false,
          "headline": "ci: fix golangci-lint v2 config schema errors",
          "author_name": "kanywst",
          "author_login": "kanywst",
          "committed_at": "2026-03-08T05:53:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 4,
      "commits_last_year": 106,
      "latest_release_at": "2026-07-19T13:28:26Z",
      "latest_release_tag": "v1.3.0",
      "releases_from_tags": false,
      "days_since_last_push": 6,
      "active_weeks_last_year": 7,
      "days_since_latest_release": 7,
      "mean_days_between_releases": 44.4
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/kanywst/brtc",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/kanywst/brtc",
          "is_deprecated": false,
          "latest_version": "v1.3.0",
          "repository_url": "https://github.com/kanywst/brtc",
          "versions_count": 4,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-19T13:21:47Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 7
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 12770,
      "source_files_sampled": 35,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/charmbracelet/lipgloss",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/mattn/go-isatty",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.23"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.10.2"
        },
        {
          "name": "github.com/trustelem/zxcvbn",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 25,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 1
      },
      "bus_factor": 1,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "kanywst",
          "commits": 85,
          "avatar_url": "https://avatars.githubusercontent.com/u/45947799?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "release.yml",
        "vhs.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "6 out of 6 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/9 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 8,
            "reason": "1 out of the last 1 releases have a total of 1 signed artifacts.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 9,
            "reason": "1 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "245794bbdab261d3d40a9b12d15315fd41bc91b0",
        "ran_at": "2026-07-26T22:34:06Z",
        "aggregate_score": 5.3,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-20T01:57:29Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-20T01:55:53Z",
      "ci_last_conclusion": null,
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/kanywst/brtc",
    "host": "github.com",
    "name": "brtc",
    "owner": "kanywst"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 58,
      "inputs": {
        "security": 53,
        "vitality": 81,
        "community": 24,
        "governance": 52,
        "engineering": 76
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 81,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 69,
            "inputs": {
              "commits_last_year": 106,
              "human_commit_share": 0.79,
              "days_since_last_push": 6,
              "active_weeks_last_year": 7
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 6 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "7/52 weeks with commits",
                "points": 4.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 7
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "106 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 106
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 98,
            "inputs": {
              "releases_count": 4,
              "latest_release_tag": "v1.3.0",
              "releases_from_tags": false,
              "days_since_latest_release": 7,
              "mean_days_between_releases": 44.4
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "4 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 7 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 7
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~44.4 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 44.4
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "1 out of the last 1 releases have a total of 1 signed artifacts.",
                "points": 8,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 24,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 52,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 13,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "moderate",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 69,
            "inputs": {
              "merged_prs": 25,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 1
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "25/26 decided PRs merged",
                "points": 36.8,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 25,
                      "decided": 26
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/9 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 51,
            "inputs": {
              "followers": 8,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "kanywst",
              "public_repos": 42,
              "account_age_days": 2778
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "8 followers of kanywst",
                "points": 6.9,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 8,
                      "login": "kanywst"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "42 public repos, account ~7 yr old",
                "points": 23.9,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 42
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 7
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "packages": [
                "github.com/kanywst/brtc"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 7
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 7 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 7
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "4 published versions",
                "points": 12,
                "status": "partial",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 76,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "3 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "6 out of 6 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 65,
            "inputs": {
              "topics": [
                "argon2",
                "bcrypt",
                "brute-force",
                "bubbletea",
                "cli",
                "cost-calculator",
                "devsecops",
                "entropy",
                "go",
                "password-cracking",
                "password-strength",
                "sarif",
                "security",
                "tui",
                "zxcvbn"
              ],
              "has_wiki": false,
              "homepage": "https://pkg.go.dev/github.com/kanywst/brtc",
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://pkg.go.dev/github.com/kanywst/brtc",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "15 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 15
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 53,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 53,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 5.3
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "6 out of 6 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/9 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "1 out of the last 1 releases have a total of 1 signed artifacts.",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "1 existing vulnerabilities detected",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 69,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "79 of 79 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 79,
                      "sampled": 79
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0.08
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "8 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 8,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 12770,
              "source_files_sampled": 35,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/35 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 35,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-26T22:34:19.556424Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/k/kanywst/brtc.svg",
  "full_name": "kanywst/brtc",
  "license_state": "standard",
  "license_spdx": "MIT"
}