About the results
What does the health index actually measure?
Publicly visible practice: commit and release history, contributor distribution, community files, engineering hygiene, security signals, and registry state — combined through a transparent, versioned methodology into one 1–100 index with five rating bands. Full detail per metric is in the wiki.
Is a high value a guarantee the software is safe?
No. Results are signals, not warranties: no line-by-line audit is performed, and no methodology can rule out an undiscovered vulnerability. What a high value does mean is documented precisely in signals, not warranties.
Why did a repository's value change without any code changes?
Two legitimate reasons: the observable evidence changed (a release aged past a threshold, an issue backlog grew), or the methodology version changed — every formula change is dated and documented in methodology versions, and each report records the version that produced it.
A metric shows "excluded" components or a null value. Is that a penalty?
The opposite. Data that cannot be observed — no published package, no issue history — is excluded and the remaining weights renormalized, never counted as zero. The rules are in the health index.
Why does organization ownership raise a repository's value?
Organization backing signals shared, accountable stewardship that can outlive any single maintainer. The lift is deliberate, bounded, and fully documented in stewardship — one of the few places the methodology takes an explicit position.
Submissions and coverage
How does a repository get into the record?
Any GitHub account may submit a public repository on the home page. Repositories meeting the documented public-interest thresholds are inspected free; others can proceed through the paid certification route — owners and maintainers can pay from an account balance directly at submission.
Which ecosystems are supported?
GitHub repositories in any language, with registry evidence read from npm, PyPI, Packagist, crates.io, Go, RubyGems, NuGet, and Hex — the full list and fallback rules are in supported ecosystems.
Can a private repository be inspected?
Private repository audits are part of the commercial roadmap, but they are not available through the current self-service product. Contact mail@inspect.software to discuss a future engagement.
Can a repository be removed from the public record?
No. Published results for public repositories stay published. Data errors are corrected, not removed: see the correction question below.
Trust and independence
Can payment improve a result?
No. Payment buys analysis, privacy, and frequency — never a different number. The methodology and formulas are identical on every tier, and no commercial relationship can alter a published result. See about for the institutional principles.
The data about a repository is wrong. How is it corrected?
Flag it through the contact channels with the repository name and the specific value in question. Confirmed data errors trigger a re-scan; methodology disagreements are answered with the documented formula — and sometimes become documented roadmap items.
Can the results be reproduced independently?
Yes, by design. Every report embeds its inputs, per-component points, scan configuration, and methodology version; every formula is published. Any value in the record can be recomputed by hand from the report's own data.
Badges
How is a badge added to a README?
Copy the Markdown or HTML snippet from the repository's report page — the badge updates automatically after every scan. Details on the badges page.
What does the badge show for an unscanned repository?
A neutral "pending" badge — never a broken image, and never an invented number.