Gitlawb/zero holds a health index of 88 out of 100, placing it in the Excellent band. It scores highest on AI Readiness (86/100) and lowest on Security (62/100). It was last updated today. 2 contributors account for most of its recent work.
88
overall / 100
Excellent
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean, calibrated against the distribution of the public record so bands carry percentile meaning; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At Risk ceiling of 34.
88
Exceptional93-100The record's top tier (≈ top 5%); essentially all checked criteria met
Excellent80-92Strong across the board; minor gaps
Good65-79Healthy; gaps are limited and manageable
Moderate50-64Acceptable with notable gaps; review recommended
Weak35-49Material weaknesses across several areas
At Risk20-34Significant weaknesses; adoption warrants caution
Critical1-19Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
The weighted overall 74 is calibrated to 88 on the published index scale (record calibration 2026-08-02).
Direct dependencies free of known advisories — no direct dependency carries a known advisory
0/25
Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
0/40
No advisories left outstanding — no advisory carries a publication date
Inputs used
source
osv
advisories
1
affected_packages
1
assessed_packages
104
unassessed_packages
0
affected_by_severity
moderate 1
direct_affected_packages
0
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 104 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight (4%): agent tooling is a real maintenance signal, but a repository with none can still reach 100/100.
Manageable file sizes — 16/1,231 source files over 60KB
Inputs used
primary_language
Go
largest_source_bytes
217,150
source_files_sampled
1,231
oversized_source_files
16
Key facts
1,104GitHub stars
28contributors
587commits, last 12 months
0days since last push
5releases
2bus factor
46open issues
Go, npmpackage ecosystems
Data collection warnings
deps.dev does not index npm:@gitlawb/zero@0.5.0; advisories assessed against the repository dependency graph instead
More detail
Star and fork history 1,104 ★ / 110 ⇿
1,104Stars
110Forks
4Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Only the most recent history is shown — this repository exceeds the collection window, so the earliest history is not captured.
Major 0Minor 4Patch 0
OpenSSF Scorecard 5.2 / 10
5.2aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-22 02:06 UTC
Full resolved dependency set from the GitHub dependency graph: 15 direct and 89 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
Registry
Package
Version
Relation
Go
charm.land/bubbles/v2
v2.1.1
direct
Go
charm.land/bubbletea/v2
v2.0.8
direct
Go
charm.land/lipgloss/v2
v2.0.5
direct
Go
github.com/alecthomas/chroma/v2
v2.27.0
direct
Go
github.com/atotto/clipboard
v0.1.4
direct
Go
github.com/aymanbagabas/go-udiff
v0.4.1
direct
Go
github.com/charmbracelet/colorprofile
v0.4.3
direct
Go
github.com/charmbracelet/x/ansi
v0.11.7
direct
Go
github.com/charmbracelet/x/term
v0.2.2
direct
Go
github.com/coder/websocket
v1.8.15
direct
Go
github.com/ledongthuc/pdf
v0.0.0-20250511090121-5959a4027728
direct
Go
golang.org/x/sys
v0.47.0
direct
Go
mvdan.cc/sh/v3
v3.13.1
direct
npm
agent-browser
0.30.1
direct
npm
tuistory
0.10.0
direct
Go
github.com/charmbracelet/ultraviolet
v0.0.0-20260703014108-f5a850f9c2b7
indirect
Go
github.com/charmbracelet/x/exp/golden
v0.0.0-20260615092313-b57e5e6d29bb
indirect
Go
github.com/charmbracelet/x/termios
v0.1.1
indirect
Go
github.com/charmbracelet/x/windows
v0.2.2
indirect
Go
github.com/clipperhouse/displaywidth
v0.11.0
indirect
Go
github.com/clipperhouse/uax29/v2
v2.7.0
indirect
Go
github.com/dlclark/regexp2/v2
v2.5.0
indirect
Go
github.com/go-quicktest/qt
v1.102.0
indirect
Go
github.com/lucasb-eyer/go-colorful
v1.4.0
indirect
Go
github.com/mattn/go-runewidth
v0.0.24
indirect
Go
github.com/muesli/cancelreader
v0.2.2
indirect
Go
github.com/rivo/uniseg
v0.4.7
indirect
Go
github.com/rogpeppe/go-internal
v1.15.0
indirect
Go
github.com/xo/terminfo
v0.0.0-20220910002029-abceb7e1c41e
indirect
Go
golang.org/x/exp
v0.0.0-20260611194520-c48552f49976
indirect
Go
golang.org/x/sync
v0.22.0
indirect
npm
@clack/core
1.4.2
indirect
npm
@clack/prompts
1.6.0
indirect
npm
@hono/node-server
1.19.14
indirect
npm
@hono/node-ws
1.3.1
indirect
npm
@opentui/core
0.2.16
indirect
npm
@opentui/core-darwin-arm64
0.2.16
indirect
npm
@opentui/core-darwin-x64
0.2.16
indirect
npm
@opentui/core-linux-arm64
0.2.16
indirect
npm
@opentui/core-linux-x64
0.2.16
indirect
npm
@opentui/core-win32-arm64
0.2.16
indirect
npm
@opentui/core-win32-x64
0.2.16
indirect
npm
@opentui/react
0.2.16
indirect
npm
@resvg/resvg-wasm
2.6.2
indirect
npm
@sec-ant/readable-stream
0.4.1
indirect
npm
@sindresorhus/merge-streams
4.0.0
indirect
npm
ansi-regex
6.2.2
indirect
npm
bun-ffi-structs
0.2.2
indirect
npm
clone
1.0.4
indirect
npm
cross-spawn
7.0.6
indirect
npm
defaults
1.0.4
indirect
npm
diff
9.0.0
indirect
npm
emoji-regex
10.6.0
indirect
npm
errore
0.11.0
indirect
npm
execa
9.6.1
indirect
npm
fast-string-truncated-width
3.0.3
indirect
npm
fast-string-width
3.0.2
indirect
npm
fast-wrap-ansi
0.2.2
indirect
npm
figures
6.1.0
indirect
npm
get-east-asian-width
1.6.0
indirect
npm
get-stream
9.0.1
indirect
npm
get-them-args
1.3.2
indirect
npm
ghostty-opentui
1.5.0
indirect
npm
goke
6.12.3
indirect
npm
hono
4.12.27
indirect
npm
human-signals
8.0.1
indirect
npm
is-plain-obj
4.1.0
indirect
npm
is-stream
4.0.1
indirect
npm
is-unicode-supported
2.1.0
indirect
npm
isexe
2.0.0
indirect
npm
kill-port-process
4.0.2
indirect
npm
marked
17.0.1
indirect
npm
npm-run-path
6.0.0
indirect
npm
parse-ms
4.0.0
indirect
npm
path-key
3.1.1
indirect
npm
path-key
4.0.0
indirect
npm
picocolors
1.1.1
indirect
npm
pid-port
2.0.1
indirect
npm
pretty-ms
9.3.0
indirect
npm
react
19.2.7
indirect
npm
react-devtools-core
7.0.1
indirect
npm
react-reconciler
0.33.0
indirect
npm
scheduler
0.27.0
indirect
npm
shebang-command
2.0.0
indirect
npm
shebang-regex
3.0.0
indirect
npm
shell-quote
1.9.0
indirect
npm
signal-exit
4.1.0
indirect
npm
sisteransi
1.0.5
indirect
npm
std-env
4.1.0
indirect
npm
string-dedent
3.0.2
indirect
npm
string-width
7.2.0
indirect
npm
strip-ansi
7.1.2
indirect
npm
strip-final-newline
4.0.0
indirect
npm
typescript
5.9.3
indirect
npm
unicorn-magic
0.3.0
indirect
npm
wcwidth
1.0.1
indirect
npm
web-tree-sitter
0.25.10
indirect
npm
which
2.0.2
indirect
npm
ws
7.5.11
indirect
npm
ws
8.21.0
indirect
npm
yoctocolors
2.1.2
indirect
npm
yoga-layout
3.2.1
indirect
npm
zigpty
0.2.1
indirect
npm
zod
4.3.6
indirect
Dependency advisories 1
This repository publishes no package the index resolves, so its own dependency graph was assessed — 104 packages, which also include development and test pins that never ship: 1 carry known advisories, of which 0 are direct.
Package
Version
Relation
Severity
Advisories
Fixed in
@hono/node-server
1.19.14
indirect
moderate
1
2.0.5
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
Feedback
Spotted something off in this report, or have thoughts to share? Wrong measurements, missed tooling, ideas, questions — anything is welcome. Every message is read and gets a response.
Related records
Inspected repositories sharing catalogue tags or ecosystems with Gitlawb/zero. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v2.10.0, schema v0.26.0 — full methodology · metrics wiki.
