Registro públicoEn riesgo
Informe de salud del softwareesquema 0.27.0 · métricas 1.13.0 · 2026-07-26 02:39 UTC
bugsyhewitt / unearth
Unearth the buried origin IP lurking behind Cloudflare, CloudFront, and other CDN veils. It unleashes 10 passive and active recon rituals in parallel, then weighs each suspect by cross-technique agreement and marks the strongest leads with confidence scores. No API keys required; Censys and Shodan crack open deeper graves if you dare.
bugsyhewitt/unearth tiene un índice de salud de 45 sobre 100, lo que lo sitúa en la banda En riesgo. Su puntuación más alta es Engineering Quality (72/100) y la más baja, Sustainability & Governance (28/100). Se actualizó por última vez hace 10 días. Una sola persona concentra la mayor parte del trabajo reciente.
45
global / 100Índice de salud del software
Las métricas se agrupan en categorías ponderadas sobre una escala de 1 a 100. El resultado global parte de su media; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe el límite 49 (En riesgo). Preparación para IA queda fuera.
45
Excelente85-100Ejemplar; cumple prácticamente todos los criterios evaluados
Bueno70-84Saludable; carencias menores
Moderado50-69Aceptable con carencias notables; se recomienda revisión
En riesgo30-49Debilidades significativas; su adopción exige cautela
Crítico1-29Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
Perfil de puntuación
Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.
Titularidad
Bugsy HewittCuenta personal
24 seguidores40 repositorios públicosdesde may 2026
Este repositorio pertenece a una cuenta personal. Un proyecto con un único propietario conlleva más riesgo de continuidad que uno respaldado por una organización.
Métricas por categoría
Vitalidad
¿Está vivo el proyecto: se escribe código y se publican versiones?
63
Actividad de desarrollo
49En riesgo
Cómo se puntúa
| 28.8/36 | Recencia de push — último push hace 10 días |
| 3.5/36 | Cadencia de commits — 5/52 semanas con commits |
| 16.6/18 | Volumen de commits — 70 commits en el último año |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Datos de entrada utilizados
| commits_last_year | 70 |
| human_commit_share | 1 |
| days_since_last_push | 10 |
| active_weeks_last_year | 5 |
Disciplina de publicación
83Bueno
Cómo se puntúa
| 27/27 | Publica versiones — 2 versiones publicadas |
| 36/36 | Recencia de las versiones — última versión hace 10 días |
| 19.8/27 | Cadencia de publicación — una versión cada ~58,2 días |
| 0/10 | OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases. |
Datos de entrada utilizados
| releases_count | 2 |
| latest_release_tag | v1.1.0 |
| releases_from_tags | no |
| days_since_latest_release | 10 |
| mean_days_between_releases | 58,2 |
Comunidad y Adopción
¿Tiene el proyecto usuarios, descargas, atención y unas condiciones acogedoras para quienes contribuyen?
29
Popularidad y adopción
11Crítico
Cómo se puntúa
| 11.3/60 | Estrellas — 6 estrellas |
| 0/25 | Forks — 1 forks |
| 0/15 | Observadores — 0 observadores |
Datos de entrada utilizados
| forks | 1 |
| stars | 6 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Salud de la comunidad
50Moderado
Cómo se puntúa
| 22.5/22.5 | README |
| 22.5/22.5 | Licencia — licencia reconocida (MIT) |
| 0/18 | Guía CONTRIBUTING |
| 0/13.5 | Código de conducta |
| 0/7.2 | Plantilla de issues |
| 0/6.3 | Plantilla de PR |
Datos de entrada utilizados
| has_readme | sí |
| has_license | sí |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Sostenibilidad y Gobernanza
¿Sobrevivirá el proyecto a sus personas: factor bus, capacidad de respuesta, quién lo respalda y mantenimiento del paquete?
28
Cómo se puntúa
| 9/54 | Factor bus — la mitad de los commits recae en 1 contribuyente(s) |
| 0/22.5 | Distribución de commits — el principal contribuyente firma el 100% de los commits |
| 1.4/13.5 | Amplitud de contribuyentes — 1 contribuyentes |
| 0/10 | OpenSSF Scorecard: Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
Datos de entrada utilizados
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Capacidad de respuesta a issues y PR
38En riesgo
Cómo se puntúa
| 0/46.8 | Resolución de issues — 0% de issues cerradas |
| 38.2/38.3 | Aceptación de PR — 45/45 PR decididos fusionados |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Datos de entrada utilizados
| merged_prs | 45 |
| open_issues | 1 |
| closed_issues | 0 |
| issue_closed_ratio | 0 |
| closed_unmerged_prs | 0 |
Propiedad y custodia
40En riesgo
Cómo se puntúa
| 10/30 | Respaldo de la propiedad — cuenta personal (usuario) |
| 0/20 | Dominio verificado — no aplicable a cuentas de usuario |
| 10.1/25 | Alcance del propietario — 24 seguidores de bugsyhewitt |
| 12.2/25 | Trayectoria — 40 repos públicos, cuenta de ~0 años |
Datos de entrada utilizados
| followers | 24 |
| owner_type | User |
| is_verified | — |
| owner_login | bugsyhewitt |
| public_repos | 40 |
| account_age_days | 84 |
Excluidos de la puntuación (sin datos o no aplicable): Dominio verificado. Los pesos restantes se han renormalizado.
Calidad de Ingeniería
¿Existen unas prácticas mínimas de ingeniería y documentación?
72
Prácticas de ingeniería
70Bueno
Cómo se puntúa
| 24/24 | Flujos de trabajo de CI — 2 flujo(s) de trabajo |
| 24/24 | Pruebas presentes |
| 16/16 | Configuración de linter — .golangci.yml |
| 0/9.6 | Hooks de pre-commit |
| 6.4/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — 0 out of 26 merged PRs checked by a CI test -- score normalized to 0 |
Datos de entrada utilizados
| has_ci | sí |
| has_tests | sí |
| has_editorconfig | sí |
| has_linter_config | sí |
| has_precommit_config | no |
Documentación
75Bueno
Cómo se puntúa
| 30/30 | README |
| 25/25 | Directorio de documentación |
| 0/15 | Sitio de documentación / página del proyecto |
| 10/10 | Descripción del repositorio |
| 0/10 | Topics |
| 10/10 | Wiki |
Datos de entrada utilizados
| topics | — |
| has_wiki | sí |
| homepage | — |
| has_readme | sí |
| has_docs_dir | sí |
| has_description | sí |
Seguridad
¿Son sólidas las prácticas visibles de seguridad y de cadena de suministro, sin exposición jurisdiccional de alto riesgo sin resolver?
30
Postura de seguridad
30En riesgo
Cómo se puntúa
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — 0 out of 26 merged PRs checked by a CI test -- score normalized to 0 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | Licencia — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — Project has not signed or included provenance with any releases. |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 6.8/7.5 | Vulnerabilities — 1 existing vulnerabilities detected |
Datos de entrada utilizados
| source | openssf_scorecard |
| checks_evaluated | 18 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 0 |
| scorecard_aggregate | 3 |
Preparación para IA
¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Es una insignia independiente y experimental — peso 0,0, de modo que se presenta por separado y no afecta a la puntuación de salud global.
70
Contexto y guía para agentes
40En riesgo
Cómo se puntúa
| 0/45 | Instrucciones para agentes — sin CLAUDE.md / AGENTS.md / reglas de editor |
| 0/15 | Documentación legible por máquinas (llms.txt) |
| 40/40 | Historial de commits legible — 65 de 70 commits humanos declaran su intención (asunto estructurado o cuerpo explicativo) |
Datos de entrada utilizados
| has_llms_txt | no |
| legible_history_share | 0,929 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Cómo se puntúa
| 18/18 | Arranque con un solo comando — Makefile |
| 22/22 | Pruebas automatizadas |
| 11/11 | Configuración de lint / formato — .golangci.yml |
| 11/11 | Verificación estática de tipos — Go (tipado estático) |
| 10/10 | Entorno reproducible — lockfile |
| 10/10 | Práctica demostrada con agentes — 36 de los últimos 70 commits con autoría o crédito de agente |
| 0/8 | Mantenimiento automatizado — no se observan actualizaciones automáticas de dependencias |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Datos de entrada utilizados
| has_nix | no |
| has_tests | sí |
| lockfiles | go.sum |
| has_dockerfile | no |
| typed_language | sí |
| bootstrap_files | Makefile |
| has_devcontainer | no |
| has_linter_config | sí |
| typecheck_configs | — |
| agent_commit_share | 0,514 |
| toolchain_manifests | go.mod |
| dependency_bot_commit_share | 0 |
Legibilidad del código para modelos
100Excelente
Cómo se puntúa
| 45/45 | Código verificable por tipos — Go (tipado estático) |
| 55/55 | Tamaños de archivo manejables — 0/111 archivos fuente de más de 60 KB |
Datos de entrada utilizados
| primary_language | Go |
| largest_source_bytes | 50.908 |
| source_files_sampled | 111 |
| oversized_source_files | 0 |
Datos clave
6estrellas de GitHub
1contribuidores
70commits en los últimos 12 meses
10días desde el último push
2versiones publicadas
1factor bus
1issues abiertas
Goecosistemas de paquetes
Advertencias de recopilación de datos
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- Could not fetch go package 'github.com/unearth-tool/unearth' from its registry
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Más detalle
OpenSSF Scorecard 3.0 / 10
3.0agregado
Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 0 | CI-Tests | 0 out of 26 merged PRs checked by a CI test -- score normalized to 0 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| 0 | Signed-Releases | Project has not signed or included provenance with any releases. |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 9 | Vulnerabilities | 1 existing vulnerabilities detected |
Dependencias directas 5
| Registro | Paquete | Restricción de versión | Manifiesto |
|---|---|---|---|
| Go | github.com/mark3labs/mcp-go | v0.48.0 | go.mod |
| Go | github.com/spf13/cobra | v1.10.2 | go.mod |
| Go | golang.org/x/time | v0.5.0 | go.mod |
| Go | gopkg.in/yaml.v3 | v3.0.1 | go.mod |
| Go | modernc.org/sqlite | v1.30.2 | go.mod |
Todas las dependencias no recopilado
No fue posible recopilar el conjunto de dependencias resuelto para este informe: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Informe JSON sin procesar legible por máquina
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 455,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 876389,
"Makefile": 603
},
"pushed_at": "2026-07-15T23:52:51Z",
"created_at": "2026-05-16T04:13:01Z",
"owner_type": "User",
"updated_at": "2026-07-15T23:52:55Z",
"description": "Unearth the buried origin IP lurking behind Cloudflare, CloudFront, and other CDN veils. It unleashes 10 passive and active recon rituals in parallel, then weighs each suspect by cross-technique agreement and marks the strongest leads with confidence scores. No API keys required; Censys and Shodan crack open deeper graves if you dare.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "v3x.tech",
"name": "Bugsy Hewitt",
"type": "User",
"login": "bugsyhewitt",
"company": null,
"location": null,
"followers": 24,
"avatar_url": "https://avatars.githubusercontent.com/u/281210152?v=4",
"created_at": "2026-05-02T16:01:55Z",
"is_verified": null,
"public_repos": 40,
"account_age_days": 84
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-07-15T08:30:11Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2026-05-18T03:25:03Z"
}
],
"recent_commits": [
{
"oid": "c0c546ca5dc5433cba621e35ef0e3b694b5164b3",
"body": "…ig_test\n\ngofmt: txtleak.go, otxpdns.go, config_test.go (missed by prior lint pass;\ntxtleak.go and config_test.go were touched by the simplify sweep).\n\nSA1019: CensysAPIID/CensysAPISecret are deprecated-but-kept fields (their own\ndocstrings say 'a later cleanup packet will remove it'). Add a scoped\ngolangci exclusion for SA1019 in pkg/config/config_test.go rather than\npeppering the test file with nolint directives.\n\nBuild and vet verified clean.",
"is_bot": false,
"headline": "fix(lint): gofmt remaining files, suppress intentional SA1019 in conf…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T23:52:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0a60ab3185c3206b39fbfba6fa3f1ab10ed719e8",
"body": "gofmt: re-format root.go, output.go, cli_test.go (tabs/whitespace drift).\n\nstaticcheck S1008 (cdn.go): simplify trailing if/return-true/return-false\npatterns in isGcoreHeaders and isEdgioHeaders to a direct return expression.\n\nrevive redefines-builtin-id (emailheader.go): rename local const max→maxL\n[…]\nr \"passivedns\"\nwhich the misspell tool incorrectly treats as a misspelling of \"passives\";\npassivedns is an established domain compound used throughout the suite.\n\nBuild and vet verified clean locally.",
"is_bot": false,
"headline": "fix(lint): resolve all pre-existing golangci-lint failures",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T23:50:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "83df52656f3151ed506b8ccd45eca47fd1e98bb4",
"body": "…, knownTechniques\n\n- Move publicOriginAddr (txtleak.go) to isPublicOriginAddr in helpers.go,\n the shared helper location; eliminates a third copy of the same private-\n address classifier alongside isPrivateAddr (emailheader) and isUnroutable\n (errorpage).\n- Extract techHitNames helper in output.\n[…]\na manual entry here to\n avoid spurious unknown-technique warnings.\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "simplify(unearth): quality sweep — dedup address filter, techHitNames…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T22:36:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7061802bb83295f25a8b8e04f589817b52f38537",
"body": null,
"is_bot": false,
"headline": "docs: add comic card image to README header",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T21:16:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fcd073e19e511008d4bdaf3f708b441bcee429f4",
"body": "…, knownTechniques (#45)\n\n- Move publicOriginAddr (txtleak.go) to isPublicOriginAddr in helpers.go,\n the shared helper location; eliminates a third copy of the same private-\n address classifier alongside isPrivateAddr (emailheader) and isUnroutable\n (errorpage).\n- Extract techHitNames helper in o\n[…]\na manual entry here to\n avoid spurious unknown-technique warnings.\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "simplify(unearth): quality sweep — dedup address filter, techHitNames…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T19:16:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b9caf8c1c95ebaa7fdded6ae9ae98803e0b24a61",
"body": "* release: cut v1.1.0\n\nBumps version string from 0.1.0-dev to 1.1.0 and promotes the\n[Unreleased] CHANGELOG section to [1.1.0] (2026-07-15).\n\nv1.0.0 was tagged at the initial release (2026-05-17, commit bef8eaf).\nThe 45 subsequent commits added 20 new discovery techniques (greynoise_asset,\notx_passi\n[…]\nchnique, --pipeline-batch, calibrate\nsubcommand, and several credential-env and favicon-hash bug fixes. All\n10 test packages pass with -race.\n\n* chore: add v1.1.0 release output.md and test-output.txt",
"is_bot": false,
"headline": "v1.1.0 release (#44)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T08:30:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "efe4c5c222cb0933815d6bf5da05eeabf7ebabcc",
"body": "…run (#43)\n\nAdds --exclude-technique <name>[,<name>...] (repeatable StringSlice flag)\nto the CLI and ExcludeTechniques []string to unearth.Options. Unknown names\nproduce a Warnings entry rather than a hard error. 7 new tests across the\nengine and CLI packages; all 10 packages pass under -race.",
"is_bot": false,
"headline": "feat(cli): add --exclude-technique flag to skip named techniques per …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T07:49:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03a1a4a80617abd43833bd752cea42f449f1200a",
"body": "Hide candidates below a supplied score threshold across all four output\nformats (jsonl, json, table, sarif). Default 0 = show all (no change to\nexisting behaviour). Validates range [0.0, 1.0] at parse time.\n\nFiles changed:\n- cmd/unearth/internal/cli/root.go: new flag + validation\n- cmd/unearth/inter\n[…]\nw tests\n- cmd/unearth/internal/cli/extra_test.go: TestFilterByConfidence unit test\n- README.md: document flag in CLI reference and quick-start\n\nAll 10 packages pass under go test ./... -count=1 -race.",
"is_bot": false,
"headline": "feat(cli): add --min-confidence threshold filter (#42)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T06:48:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7822855166fc417da593a764562e0591d9f99bf8",
"body": "…integration (#41)\n\nAdd `-o sarif` output format that emits a SARIF 2.1.0 document with one\nresult per candidate IP. Each result carries rule UNEARTH001, a level\nderived from the confidence score (error ≥0.80, warning ≥0.50, note\n<0.50), a logicalLocation of the target domain, and a properties bag\nw\n[…]\n cap, multi-target\naggregation, and the sarifLevel helper directly.\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(output): add SARIF 2.1.0 output format for GitHub Code Scanning …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T06:27:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b013cc4484bc3674aeaf191f40b68f06d7bf3724",
"body": "… and CredentialStatus coverage (#40)\n\nFive credential sets (ZoomEye, Chaos/PDCP, VirusTotal, URLScan, GreyNoise)\nwere missing from allCredentialEnvVars in pkg/config/config_test.go. Tests\ncalling clearCredentialEnv did not clear these vars, so a real GREYNOISE_API_KEY\n(for example) in a CI shell co\n[…]\nnd expand the brief technique list to name JARM and ASN-range sweep\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test(config): fix credential env-isolation gap; extend canonical-name…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T06:10:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3925e9302fe2e3fb24deabdd202cc13147cf26d0",
"body": "…n_hash pre-filter bug (#39)\n\nSeven techniques shipped after v1.0 (split_dns, email_header, jarm_fingerprint,\nasn_sweep, shodan_cve, favicon_hash, dns_txt_leak) were never added to\nknownTechniques or the default-weights YAML files, so users who tried to\noverride their weights received spurious \"unkn\n[…]\nKeyFor_FaviconHash, TestHasKeyFor_AllKeyRequiringTechniquesCovered.\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(config): wire post-v1.0 techniques into config system; fix favico…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T05:42:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8014c2f37baa2ad4b71f1e5099f562eff225a35b",
"body": "…38) (#38)\n\nThree new tools in unearth-mcp give AI agents low-overhead introspection\nand filtering capabilities without running a full discovery pipeline:\n\n- unearth_check_cdn: CDN fingerprinting for a hostname using the same\n DNS/IP-range/header detection as the discovery engine; surfaces the\n CD\n[…]\nded to cmd/unearth-mcp/main_test.go; all pass.\nMCP server grows from five to eight tools. POST_V01.md updated to mark\nP2 FOFA/Netlas/CriminalIP, P3 pipeline-batch, and P3 MCP expansion as\nimplemented.",
"is_bot": false,
"headline": "feat(mcp): add check_cdn, is_cdn_ip, list_techniques utility tools (#…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T04:05:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2a581744429eea498b5fcfc04f013cd008a74bda",
"body": "…hnique (#37)\n\n- Implement JARM 10-probe active technique in pkg/techniques/jarm.go; self-\n contained pure-Go port of the Salesforce JARM algorithm with no new external\n dependency (no jarm-go module required).\n- Weight corrected to 0.80 per spec (was 0.70); all 12 unit tests updated.\n- Known CDN-\n[…]\nws from RunOptions.SeedIPs like host_header.\n- README techniques table updated: weight 0.70 → 0.80.\n- POST_V01.md: P2 jarm_fingerprint section marked ✅ IMPLEMENTED with\n implementation summary block.",
"is_bot": false,
"headline": "feat(techniques): ship jarm_fingerprint active TLS fingerprinting tec…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T02:43:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "84b0724af806769bc431dd2a39c6ec5eeb9fd429",
"body": "Both techniques shipped in prior laps (f22984b / 6bb8904) but\nPOST_V01.md was not updated with the ✅ IMPLEMENTED markers.",
"is_bot": false,
"headline": "docs(POST_V01): mark asn_sweep and split_dns as implemented (#36)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T02:10:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34a205f4da98dd2874bf91d95a0ee588ad938b5c",
"body": "…e (necro-phase2-r1) (#34)\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(unearth): add dns_txt_leak passive TXT-record origin-IP techniqu…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-06-05T19:20:19Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7c21ac76218e5040c6ab675cb7b2e316b0acee43",
"body": "Add two widely-used CDN providers that were previously missing from the\nfilter, causing Vercel- and Netlify-hosted origins to appear as unfiltered\ncandidates in scan results.\n\n- Embed IPv4/IPv6 CIDR ranges for Vercel (AS13335-edge) and Netlify (AS137954)\n- Add buildVercel()/buildNetlify() with canon\n[…]\nproviders in init() after cachefly\n- 22 new tests: IP range, DNS hint, and header detection for both providers\n\nCloses #36\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(cdn): add Vercel Edge Network and Netlify CDN providers (#33)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-06-05T15:02:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "32920fa2b85bb0092210cdfc5c8b5da4954107d5",
"body": "…#32)\n\nAdds greynoise_asset, the 17th asset-discovery technique, querying\nGreyNoise's GNQL search for IPs whose rDNS or organization metadata\nself-advertises under the target apex. A sensor-observed-noise pivot\northogonal to every existing backend: the IP must be currently live\n(GreyNoise sensors ob\n[…]\nufficient). Pagination via scroll cursor with a\n10-page ceiling. Results cached 1h.\n\nCo-authored-by: unearth-worker <worker@necromancer.local>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add greynoise_asset sensor-observed-noise backend (…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T04:19:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e7afe2d1110bf7075f6006cf8437d8ac7c8ba70f",
"body": "Sixteenth asset-discovery backend. Inverts shodan_cert's signal: rather\nthan requiring the candidate host to reuse the front-door TLS\ncertificate, it requires the candidate host to expose a specific known\nvulnerability. Given an operator-supplied CVE id (--cve flag) and the\ntarget apex, queries Shod\n[…]\ndates) mirroring\nthe email_header operator-supplied-scope idiom.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add shodan_cve discovery technique (#31)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T03:22:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "02e371b2563e1816e69698e5c4758b430bd13c76",
"body": "Adds the fifteenth asset-discovery backend, intentionally orthogonal to\ncensys_cert. Where censys_cert pivots on the target's TLS leaf-certificate\nSHA-256 (and so only surfaces hosts that reuse the front-door certificate),\ncensys_ipv6 pivots on the target's DNS apex via the Censys Platform\nhost.dns.\n[…]\nGELOG.md unreleased entry added\n\nTest suite: go test ./... — all packages pass.\n\nCo-authored-by: unearth-worker-r33 <worker@necromancer.local>\nCo-authored-by: Claude Sonnet 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add censys_ipv6 IPv6 asset-discovery backend (#30)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T02:06:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "31671cb0a338bd495a11abc303bc5e4ead689d30",
"body": "… backend (#29)\n\nThe fourteenth asset-discovery backend. AlienVault OTX passive-DNS\nqueries (GET /api/v1/indicators/domain/{domain}/passive_dns) surface\nhistorical hostname-to-IP observations from OTX's honeypot/sensor\nnetwork, community-submitted analyst pulse feeds, and partner DNS\ntelemetry. Diff\n[…]\ny update\n- docs/techniques.md detailed section\n- CHANGELOG entry\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add otx_passivedns keyless threat-intel passive-DNS…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T00:43:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1f86d032b239554beb4d9b1e70f82e3f99459f9b",
"body": "…end (#28)\n\nShips the 13th OSINT asset-discovery backend, urlscan_asset (passive tier,\nweight 0.66). Like fullhunt_asset, zoomeye_asset, chaos_asset, and\nvirustotal_passivedns -- and unlike the eight cert-fingerprint engines --\nthis is not a cert pivot. It queries URLScan.io's /api/v1/search/ endpoi\n[…]\nonfigs/default-weights.yaml so the embed-vs-source guard passes.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add urlscan_asset browser-scan asset-discovery back…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T00:28:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "82854303166a405e06437a1773891457719c3f3e",
"body": "…end (#27)\n\nThe twelfth asset-discovery backend, and the fourth non-cert-pivot enumerator\nalongside fullhunt_asset, zoomeye_asset, and chaos_asset. Queries VirusTotal's\nv3 /domains/{domain}/resolutions endpoint for every historical hostname->IP\nobservation in its passive-DNS corpus and emits the non\n[…]\nrsor pagination.\nFull suite green with -race: 538 passing tests.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add virustotal_passivedns temporal passive-DNS back…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T22:14:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f92b6ebe9ad61699556fe47a99e65db5886f395b",
"body": "…nd (#26)\n\nThe eleventh asset-discovery backend and the eighth independent\ncertificate-pivot engine. The two backends originally suggested for this\nslot — BinaryEdge and LeakIX — were already shipped (`binaryedge_cert`\n0.72 and `leakix_cert` 0.71). Onyphe (onyphe.io) was selected as the\nnext-best un\n[…]\nboration weight pending\ncalibration.\" The calibrate subcommand will refine this weight from\nreal-world corroboration data.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(techniques): add onyphe_cert EU-weighted certificate-pivot backe…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T21:10:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "56510424d664861df6529d28d08246e774691273",
"body": "…backend (#25)\n\nAdd chaos_asset, the tenth asset-discovery backend, querying ProjectDiscovery's\nChaos dataset (the corpus behind subfinder). Verified neither Mercury/Chaos nor\nCensys Communities was already shipped; Censys Communities was rejected as too\nclose to the shipped censys_cert (Censys Plat\n[…]\nHANGELOG.\n\ngo test -race ./... is green; go vet and gofmt clean.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add chaos_asset ProjectDiscovery subdomain-dataset …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T20:11:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4118cb60da668123f0c431df57b3ea969b773e6e",
"body": "…tion backend (#24)\n\nAdds ZoomEye as the ninth passive recon backend (passive tier, weight 0.68).\nLike fullhunt_asset, and unlike the seven cert-fingerprint engines, this is a\ndomain host enumerator rather than a cert pivot: it queries ZoomEye's\ndomain-search API for the associated hosts crawled und\n[…]\nys section, and explanatory\nnote updated; CHANGELOG entry added.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add zoomeye_asset APAC-coverage domain host-enumera…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T19:08:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3e98560b419245900793bb2511dcc5071bd7c16c",
"body": "…backend (#23)\n\n* feat(techniques): add leakix_cert SHA-1 certificate-fingerprint pivot\n\nAdd LeakIX (leakix.net) as the seventh independent cert-pivot backend,\nalongside censys/shodan/fofa/netlas/criminalip/binaryedge. It fingerprints\nthe target's TLS leaf cert (SHA-1, the Shodan/BinaryEdge flavor) \n[…]\nuthored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add fullhunt_asset attack-surface host-enumeration …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T18:05:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "17bb8f0830cff42e0769992d9011bde3948fe92a",
"body": "…ivot (#22)\n\nAdd BinaryEdge as a sixth independent certificate-pivot backend alongside\ncensys_cert, shodan_cert, fofa_cert, netlas_cert, and criminalip_asset.\nbinaryedge_cert (passive, weight 0.72) fingerprints the target's TLS leaf\ncert SHA-1 and queries the BinaryEdge host-search API for every sca\n[…]\nalip previously fell to\nthe default false branch and never ran).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add binaryedge_cert SHA-1 certificate-fingerprint p…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T14:54:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "cd9f40a5808f648a71d780d345e23611fc6966d9",
"body": "The README instructed users to export CENSYS_PLATFORM_PAT, SHODAN_API_KEY,\nSECURITYTRAILS_API_KEY, VIEWDNS_API_KEY, FOFA_EMAIL/FOFA_KEY, NETLAS_API_KEY,\nand CRIMINALIP_API_KEY, but LoadAPIKeys only read the UNEARTH_-prefixed\naliases. Any user following the docs had their keys silently ignored and ev\n[…]\n and documents the\nalias precedence in the README and CHANGELOG.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: honor documented API-key env var names (#21)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T13:36:04Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0073801103a2e6824f919de5d15657d1b67d72c1",
"body": "Add Criminal IP (criminalip.io) as the fifth passive cert-fingerprint\npivot backend alongside censys_cert, shodan_cert, fofa_cert, and\nnetlas_cert. Fingerprints the target's TLS leaf cert (SHA-256) and\nqueries the Criminal IP banner search API for assets presenting the\nsame fingerprint, surfacing no\n[…]\n error\nclassification path) plus a config CredentialStatus test.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add criminalip_asset cert-fingerprint pivot (#20)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T12:35:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a544fcf8d556ae7f6fb1b196197a6aa0fbb19892",
"body": "Add the Netlas (netlas.io) certificate-fingerprint pivot as the next P2\nsearch backend, paralleling censys_cert, shodan_cert, and fofa_cert. It\nfingerprints the target's TLS leaf cert (SHA-256), queries Netlas's response\nindex for hosts sharing the fingerprint, and emits non-CDN hits as origin\ncandi\n[…]\nnto config, default weights (both copies),\ncredential reporting, the CLI status banner, and the MCP cert-fingerprint tool.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(techniques): add netlas_cert certificate-fingerprint pivot (#19)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T11:33:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "98071ddabbfe166ce6ec814326513a025654fec5",
"body": "…h3 (#18)\n\nThe github.com/spaolacci/murmur3 v1.1.0 dependency performs unsafe\npointer arithmetic in Sum32WithSeed that trips Go's -race / checkptr\ninstrumentation (\"checkptr: pointer arithmetic result points to invalid\nallocation\"), crashing the favicon_hash test under the race detector and\nkeeping \n[…]\nependency from go.mod/go.sum.\n\ngo test -race ./... is now green.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(favicon): replace murmur3 dep with pointer-safe pure-Go MurmurHas…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T10:27:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e36caa11427e5ee82e1d5e22da767d1d288ec4ae",
"body": "Add fofa_cert, a passive cert-fingerprint pivot technique that queries\nFOFA (fofa.info) for hosts presenting the target's TLS leaf-cert SHA-256,\nmirroring the existing censys_cert / shodan_cert pattern. FOFA's 4B+ asset\nindex has substantially heavier APAC scan coverage than the US-centric\nShodan an\n[…]\nappy path,\nboth-keys-required skip, empty/quota/bad-cred/403/generic-error/malformed\npaths, port stripping, and metadata).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(techniques): add fofa_cert FOFA certificate-fingerprint pivot (#17)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T09:28:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "be7bd3cab470e8128c5433bc6d18fe7a8bf731bd",
"body": "Adds CacheFly to the CDN provider registry so its edge IPs are filtered\nout of origin-candidate lists and surfaced as a recognized CDN.\n\nDetection signals (all non-colliding with existing providers):\n- IP ranges: AS30081 blocks (205.234.0.0/19, 204.93.150.0/23,\n 204.93.157.0/24, 2620:e6::/32). The \n[…]\nThe TestNoDuplicatePrefixAcrossProviders\ncollision guard passes.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add CacheFly (CacheNetworks) provider detection (#16)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T08:15:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "860de2bdce36fdaa027c9398d0e216e721d7f3c7",
"body": "Add Gcore (G-Core Labs S.A., AS199524) to the CDN provider registry so\nits edge IPs are filtered from origin candidates instead of polluting\nresults. Detection uses embedded edge ranges, gcdn.co/gcorelabs.com/\ngcore.com CNAME suffixes, the Server: gcore marker, the X-Gcore-* header\nfamily, and an X-\n[…]\nregistry-wide\nTestNoDuplicatePrefixAcrossProviders guard passes.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add Gcore (G-Core Labs) provider detection (#15)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T07:18:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "35fe0665b2f602bf60619c3ed60fd1904fd52c78",
"body": "KeyCDN (proinity GmbH, AS199653) is now a recognized CDN provider, so its\nedge IPs are filtered from origin candidates instead of polluting results.\nDetection uses embedded edge ranges, the kxcdn.com/keycdn.com CNAME\nsuffixes, the Server: keycdn-engine marker, X-Edge-Location and X-Pull\nheaders, and\n[…]\nCDN-\nexclusive; the registry-wide duplicate-prefix guard passes.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add KeyCDN provider detection (#14)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T06:15:40Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d07ddc47be477e22738ae525b79e3a37d2c770e4",
"body": "Edgio — the 2022 merger of Limelight Networks and Edgecast (Verizon\nMedia) — is the highest-traffic-share enterprise CDN still unmodeled\nafter CDN77. Adding it to the registry stops its edge IPs from polluting\norigin candidates.\n\nDetection is fully self-contained (no API key, no new dependency):\nemb\n[…]\nDME CDN\ncoverage, CHANGELOG, and the POST_V01 landscape summary.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add Edgio (Limelight / Edgecast) CDN detection (#13)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T05:14:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "37c926eecc4f2e13a4b5648b8f6e6b8c772a735f",
"body": "Adds CDN77 as a recognized provider in the CDN registry so its edge IPs\nare filtered from origin candidates instead of polluting results.\n\nDetection mirrors the existing BunnyCDN / StackPath pattern exactly:\nembedded edge IP ranges (AS60068, DataCamp Limited / CDN77 s.r.o.), the\ncdn77.org / cdn77-ss\n[…]\n traffic in that block unreachable. Removed the erroneous entry.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add CDN77 (DataCamp) detection (#12)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T04:06:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e7d3d9dc40afbff956c6640c88bbfb44837f43ff",
"body": "BunnyCDN is now a recognized provider in the CDN registry, so its edge\nIPs are filtered from origin candidates instead of polluting results.\n\nDetection signals:\n- Embedded edge IP ranges (primary ASN AS200325, BunnyWay d.o.o.)\n- b-cdn.net / bunnycdn.com / bunny.net CNAME suffixes\n- Server: BunnyCDN-\n[…]\nor, Google Cloud CDN, and StackPath/Highwinds providers exactly.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add BunnyCDN (bunny.net) detection (#11)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T02:58:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "577af9fab7dcbf9ad7c5d0077bb41a59aeabc385",
"body": "Add StackPath (formerly Highwinds Network Group / NetDNA / MaxCDN) to the\nCDN provider registry so its edge IPs are filtered from origin candidates\ninstead of polluting discovery results.\n\nDetection signals:\n- embedded Highwinds edge ranges (ASNs AS20446 / AS33438)\n- stackpathcdn.com / stackpathdns.\n[…]\n Cloud CDN providers.\n\nTests: 343 -> 348 (cdn package 44 -> 49).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add StackPath/Highwinds CDN detection (#10)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T00:05:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "73689ea17aa724dbbec272572f8d7d72c4c7f56a",
"body": "Adds Google Cloud CDN (Google Front End / global external HTTP(S) load\nbalancer) as a recognized provider in the CDN registry so its anycast\nand GFE edge IPs are filtered from origin candidates instead of\npolluting results — the next CDN coverage gap named in POST_V01.md.\n\nDetection signals, mirrori\n[…]\n\nIPv4/IPv6 range matching, DNS hints, and header classification.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add Google Cloud CDN detection (#9)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T23:06:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "55d7ac1ba500f4708fe8820eed95c4299707703b",
"body": "Azure Front Door is now a recognized provider in the CDN registry, so its\nanycast edge IPs are filtered from origin candidates instead of polluting\nresults. Detection uses embedded AzureFrontDoor service-tag ranges, the\nazurefd.net/azureedge.net/t-msedge.net/trafficmanager.net CNAME suffixes,\nthe pr\n[…]\n in the\nPOST_V01 landscape summary alongside Akamai and Imperva.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: add Azure Front Door CDN/WAF detection (#8)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T22:14:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8d2bf40cf631d2a92e29cb0dff6b6b496c803e18",
"body": "Imperva is a top-tier enterprise WAF/CDN that was missing from the CDN\nregistry, so its edge IPs were surfaced as origin candidates by the\ncert- and subdomain-based techniques, polluting results for any\nImperva-fronted target.\n\nAdd it as a provider mirroring the Akamai pattern: embedded edge IP\nrang\n[…]\nCHANGELOG, and POST_V01.md (also marks Akamai coverage shipped).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add Imperva (Incapsula) CDN/WAF detection (#7)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T21:26:48Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "14468c22bd144c71aaaec2ab0b055d61284f83db",
"body": "…3) (#6)\n\nRecord a per-technique observation after each discovery run — whether the\ncandidate that technique surfaced was corroborated by another technique in\nthe same run — and add `unearth calibrate` to turn that accumulated history\ninto per-technique precision estimates and suggested weight overr\n[…]\nort and\nnever affects discovery; --no-cache runs record nothing.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(calibrate): weight auto-calibration from run history (POST_V01 P…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T20:43:33Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b4b26a3698599718743127d287f6a51d89146b82",
"body": "…(#5)\n\nImplements the P3 \"Bulk target parallelism (pipeline mode)\" direction from\nPOST_V01.md. List/stdin runs previously processed targets strictly one at a\ntime, which is slow for large subdomain pipelines (subfinder | unearth -l -).\n\n--pipeline-batch <n> runs discovery across a bounded worker poo\n[…]\n, batch-size clamping,\nand invalid-batch validation. Race-clean.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cli): add --pipeline-batch for concurrent bulk-target discovery …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T19:59:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8745581042b3510516788827bbe70517c3a682e3",
"body": "…g (#4)\n\nAdds the email_header technique (passive tier, weight 0.85), the\nhighest-ranking unimplemented POST_V01 item that needs no external API\nkey. Parses an operator-supplied raw email via net/mail, walks the\nReceived: header chain, and surfaces public non-CDN relay IPs as origin\ncandidates — mai\n[…]\n SMTP-probe variant is\ndeferred (needs operator infrastructure).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add email_header passive .eml Received-header minin…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T19:04:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "48b11092474368fb9de50a29ae2614fc050be7d6",
"body": "Implements the Salesforce JARM active server-fingerprinting method as a\nself-contained pure-Go technique (no external module dependency). It\nsends ten crafted TLS ClientHello probes to each phase-1 candidate IP,\nfolds the handshake responses into a 62-character fingerprint, and flags\ncandidates whos\n[…]\ning/ServerHello-parsing internals\noffline, with no live network.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "add jarm_fingerprint active TLS fingerprinting technique (#3)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T12:48:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6bb8904ecb78934af56216b280787fb924a34305",
"body": "Detects split-DNS / partial-proxy misconfigurations where only the www\nhostname is routed through a CDN while the apex or a mail/admin sibling\nis left in DNS-only mode pointing straight at the origin. Resolves apex\nand www to establish a CDN-fronted front door, then flags non-CDN IPs on\nthe apex and\n[…]\nentials, so the highest-ranked keyless item was shipped instead.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add split_dns partial-proxy origin detection (#2)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T12:00:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fe60d0ebc9afdd670a9818e034f548da287e64b0",
"body": null,
"is_bot": false,
"headline": "feat: Akamai CDN detection — IP ranges, CNAME suffixes, response headers",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-27T02:52:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f22984b2dede8f5269f1ff568dfedee001bc7dde",
"body": null,
"is_bot": false,
"headline": "feat: asn_sweep technique — BGPView ASN-range origin discovery",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-27T01:47:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a641747723af54a0b3160f80e0a3f66104952c4c",
"body": "Fetch the target's /favicon.ico (HTTPS with HTTP fallback), compute its\nMurmurHash3 using Shodan's convention -- mmh3(base64.encodebytes(bytes))\nas a signed int32 -- and query Shodan (http.favicon.hash) and/or Censys\n(services.http.response.favicons.hashes) for hosts sharing that favicon.\nNon-CDN hi\n[…]\nrt) miss.\nEither API key alone is sufficient; with neither configured the\ntechnique skips gracefully, matching the existing keyed techniques.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add favicon_hash origin-discovery technique",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-26T23:34:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fdb0db7bed326ab466a4a821ae2907d5dbaa90fc",
"body": "Research lap covering CDN bypass and origin-discovery landscape through\nmid-2026. Ranks 9 improvement areas (P1-P4) by signal-to-effort ratio:\nfavicon hash pivoting, ASN-range sweep, Akamai CDN coverage, FOFA/Netlas\nintegration, JARM fingerprinting, split-DNS detection, email header leak,\npipeline parallelism, and JA4 fingerprinting.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "research: add POST_V01.md with ranked post-v1.0 directions (#1)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-26T18:43:30Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bef8eafcfd9f8d3142b523390dd3a9d46d1882bd",
"body": null,
"is_bot": false,
"headline": "fix: remove invalid changelog.source field from .goreleaser.yaml",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-18T03:23:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03c8a9f34fdc2dafa39b454b887400ebbde10705",
"body": "… workflow, v1.0.0",
"is_bot": false,
"headline": "Packet 7: README, docs (techniques, mcp, ranking), CHANGELOG, release…",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-18T02:54:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6bf5a19417feded253bd4f23f9cfab411ff209cc",
"body": "… (Fastly, Sucuri)",
"is_bot": false,
"headline": "Packet 6: MCP server (5 tools, stdio transport) + CDN dataset upgrade…",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-18T02:46:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e964cbc672f936fc83eec91d5b83a0644241974",
"body": null,
"is_bot": false,
"headline": "Packet 5B: add report and create docs/reports directory",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-18T02:28:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e0c147136c1558f341f1e738c2246d11fa846911",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-17T14:36:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7ca26b96a76b65daff76791708afac286d1dbe19",
"body": null,
"is_bot": false,
"headline": "chore: nudge GitHub contributor-stats cache",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-17T14:04:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed034e60cfe4ce18e34b8ef89141df7b5016b909",
"body": "Adds the keyless cert-pivot capability that makes the free tier\nuseful, hardens the existing crt.sh path, and gives slow techniques\ntheir own timeout budget.\n\nct_fingerprint (passive, no key, weight 0.70):\n- Backend A: kaeferjaeger.gay/sni-ip-ranges streaming download of\n five provider files (amazo\n[…]\n\nCoverage: pkg/techniques 83.9% (up from 82.4%), pkg/unearth 84.4%\n(up from 83.9%). No regression. e2e keyless run against example.com\nnow returns 62k candidates in 67s — meaningful free-tier results.",
"is_bot": false,
"headline": "Packet 5B: ct_fingerprint, crtsh hardening, per-technique timeouts",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T23:01:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f4001831d097f2839d5f816503ec4a1dc02834e9",
"body": "Adds five new techniques and the two-phase orchestration model they\nneed to be useful:\n\n- shodan_cert (active, 0.85) — TLS leaf-cert SHA-1 fingerprint\n pivoting via the Shodan /shodan/host/search endpoint, with the\n same tier_insufficient handling as censys_cert.\n- host_header (active, 0.85, consu\n[…]\nmat) while\ncensys_cert keeps SHA-256 — both share one dial via leafCertDER.\n\nCoverage: every new technique file ≥ 76%; package totals climb to\ntechniques 82.4%, unearth 83.9%; no regression elsewhere.",
"is_bot": false,
"headline": "Packet 5A: active & aggressive techniques + phased engine",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T21:03:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d801c0f67ffb9591a8bfa879a078f3a59dccd565",
"body": null,
"is_bot": false,
"headline": "lint: gofmt tty.go after removal of unused type",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:23:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1999bb90488b3414d579605e548df0b4aec7aceb",
"body": null,
"is_bot": false,
"headline": "lint: rename shadowing 'cap', drop unused discardTTY",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:22:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c2e87a489daa5fa4b75b0211f015c58d9db44b3a",
"body": "Adds the real unearth CLI in cmd/unearth/internal/cli, replacing the\nstub. main.go is thin: it calls cli.Run with os streams and exits with\nthe returned code. The package implements:\n\n- Root command running discovery on a single target, a -l <file>, or\n piped stdin (precedence in that order; ignore\n[…]\nes\n unwind cleanly.\n\nAlso adds an optional WeightsPath field to unearth.Options so --weights\nthreads through to config.LoadWeights (small additive change to the\nlibrary API authorized by the packet).",
"is_bot": false,
"headline": "Packet 4 Part C: CLI with cobra, three output formats, cache subcommands",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:20:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4feb632dcb7860697a30e7236480526ecc37a0ff",
"body": "The Censys Search v2 API is disabled for Free accounts and is being\nsunsetted in 2026; the legacy ID+secret pair no longer authenticates\nagainst any endpoint we can call. Move censys_cert to the Censys\nPlatform API:\n\n- POST https://api.platform.censys.io/v3/global/search/query with\n CenQL body host\n[…]\nas missing.\n- Tests rewritten: Bearer header asserted, search body parsed and\n validated, multi-page pagination exercised, empty/missing-PAT/\n budget-exhausted/HTTP-error/malformed-JSON all covered.",
"is_bot": false,
"headline": "censys_cert: migrate to the Censys Platform API",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:13:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b9ceede28b39e642b1b0110b0ec93f90dc342a10",
"body": null,
"is_bot": false,
"headline": "lint: wrap remaining deferred Body.Close in errcheck-friendly closure",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:05:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75a8321837029037b0431311a524ece6129e0772",
"body": "Wrap deferred Close() calls in errcheck-friendly closures, rename the\n'cap' identifier that shadowed the builtin, suppress unused-parameter\nwarnings on test/handler arguments that genuinely are unused, add a\njustifying comment to the modernc.org/sqlite blank import, and convert\na switch-true into a tagged switch per staticcheck QF1002.",
"is_bot": false,
"headline": "lint: fix errcheck, revive, and staticcheck findings",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:04:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f48a2e0e4c47ef7418a93eab2909d6c87b4865c2",
"body": null,
"is_bot": false,
"headline": "ci: bump golangci-lint-action to v7 for v2 support",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:00:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d3fe7a4d5f2a3ceb3d6a717c77d1c39b405aaef4",
"body": "Adds:\n- pkg/cdn: Cloudflare + CloudFront detection (DNS, headers, IP range\n match) with embedded range snapshots (2026-05-16) and a Refresh()\n hook for fetching fresh ranges.\n- internal/httpclient: shared HTTP client with tuned timeouts, redirect\n cap, TLS config, and User-Agent stamping.\n- Five \n[…]\ne.com, surfaces 2\n crt.sh candidates).\n\nCoverage: cdn 87.3%, techniques 78.3%, unearth 83.2%, httpclient 100%,\ncache 86.2%, config 92.9%, ratelimit 96.2%. CGO_ENABLED=0 builds\nclean. Race tests pass.",
"is_bot": false,
"headline": "Packet 3: passive techniques, CDN detection, orchestration engine",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T12:35:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f6e86ad05bbe021671927563c4d85a85aa6bba0b",
"body": "Bump Go floor from 1.22 to 1.23 in go.mod and README (dep graph requires\nit), pin CI Go to 1.23 on test/vet/lint, keep build matrix on stable.\nMigrate .golangci.yml to v2 schema (file shipped with Packet 3) and bump\nCI lint pin to golangci-lint v2.12.2.",
"is_bot": false,
"headline": "Packet 3 prep: Go floor and lint config",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T12:15:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a9f1ae86c9be10a3c3b268149594bc7a126da59",
"body": "Implements pkg/config (YAML weights w/ embedded defaults + XDG override,\nAPI key loading from env, credential status helper), pkg/cache (pure-Go\nmodernc.org/sqlite with WAL, deterministic Key(), TTL eviction, Purge,\nStats) and internal/ratelimit (per-key x/time/rate token buckets and a\nconcurrent-safe Budget for paid-API caps). All three satisfy the\ninterfaces declared in pkg/techniques. Coverage: config 92.9%, cache\n86.2%, ratelimit 96.2%. Builds clean with CGO_ENABLED=0; race tests pass.",
"is_bot": false,
"headline": "Packet 2: config loader, SQLite cache, rate limiter & budget",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T10:18:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7c8213f940c6c9cf0e4a519ec057ccc9cce7188a",
"body": null,
"is_bot": false,
"headline": "Initial scaffold: project structure, core types, ranking engine",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T06:54:20Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 2,
"commits_last_year": 70,
"latest_release_at": "2026-07-15T08:30:11Z",
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_last_push": 10,
"active_weeks_last_year": 5,
"days_since_latest_release": 10,
"mean_days_between_releases": 58.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": []
},
"popularity": {
"forks": 1,
"stars": 6,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-07-08",
"count": 1
}
],
"complete": true,
"collected": 1,
"total_forks": 1
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 50908,
"source_files_sampled": 111,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/mark3labs/mcp-go",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.48.0"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "golang.org/x/time",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.5.0"
},
{
"name": "gopkg.in/yaml.v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.0.1"
},
{
"name": "modernc.org/sqlite",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.30.2"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 45,
"open_issues": 1,
"closed_ratio": 0,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "bugsyhewitt",
"commits": 70,
"avatar_url": "https://avatars.githubusercontent.com/u/281210152?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"release.yml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 26 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "c0c546ca5dc5433cba621e35ef0e3b694b5164b3",
"ran_at": "2026-07-26T02:38:57Z",
"aggregate_score": 3,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-15T23:53:56Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-15T22:36:50Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 35,
"created_at": "2026-07-03T02:32:19Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/bugsyhewitt/unearth",
"host": "github.com",
"name": "unearth",
"owner": "bugsyhewitt"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 45,
"inputs": {
"security": 30,
"vitality": 63,
"community": 29,
"governance": 28,
"engineering": 72
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 63,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "at_risk",
"name": "Development activity",
"note": null,
"notes": [],
"value": 49,
"inputs": {
"commits_last_year": 70,
"human_commit_share": 1,
"days_since_last_push": 10,
"active_weeks_last_year": 5
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 10 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "5/52 weeks with commits",
"points": 3.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 5
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "70 commits in the last year",
"points": 16.6,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 70
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "good",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 83,
"inputs": {
"releases_count": 2,
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_latest_release": 10,
"mean_days_between_releases": 58.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "2 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 2
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 10 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~58.2 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 58.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 29,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 11,
"inputs": {
"forks": 1,
"stars": 6,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "6 stars",
"points": 11.3,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 6
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "1 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 1
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "critical",
"name": "Sustainability & Governance",
"value": 28,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "at_risk",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 38,
"inputs": {
"merged_prs": 45,
"open_issues": 1,
"closed_issues": 0,
"issue_closed_ratio": 0,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "0% of issues closed",
"points": 0,
"status": "missed",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 0
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "45/45 decided PRs merged",
"points": 38.2,
"status": "met",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 45,
"decided": 45
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 40,
"inputs": {
"followers": 24,
"owner_type": "User",
"is_verified": null,
"owner_login": "bugsyhewitt",
"public_repos": 40,
"account_age_days": 84
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "24 followers of bugsyhewitt",
"points": 10.1,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 24,
"login": "bugsyhewitt"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "40 public repos, account ~0 yr old",
"points": 12.2,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 40
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 72,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 6.4,
"status": "met",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 26 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 30,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": null,
"notes": [],
"value": 30,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 18,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 0,
"scorecard_aggregate": 3
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 26 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 70,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.929,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "65 of 70 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 65,
"sampled": 70
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 82,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0.514,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "36 of the last 70 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 36,
"sampled": 70
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 50908,
"source_files_sampled": 111,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/111 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 111,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"Could not fetch go package 'github.com/unearth-tool/unearth' from its registry",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-26T02:39:14.320787Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/b/bugsyhewitt/unearth.svg",
"full_name": "bugsyhewitt/unearth",
"license_state": "standard",
"license_spdx": "MIT"
}Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.
Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v1.13.0, esquema v0.27.0 — metodología completa · wiki de métricas.
Cómo se sitúa un resultado dentro del registro general: estadísticas agregadas.