Public recordAt risk
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-26 02:39 UTC
bugsyhewitt / unearth
Unearth the buried origin IP lurking behind Cloudflare, CloudFront, and other CDN veils. It unleashes 10 passive and active recon rituals in parallel, then weighs each suspect by cross-technique agreement and marks the strongest leads with confidence scores. No API keys required; Censys and Shodan crack open deeper graves if you dare.
bugsyhewitt/unearth holds a health index of 45 out of 100, placing it in the At risk band. It scores highest on Engineering Quality (72/100) and lowest on Sustainability & Governance (28/100). It was last updated 10 days ago. A single contributor accounts for most of its recent work.
45
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
45
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Ownership
Bugsy HewittPersonal account
24 followers40 public repossince May 2026
This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
63
Development activity
49At risk
How it's scored
| 28.8/36 | Push recency — last push 10 days ago |
| 3.5/36 | Commit cadence — 5/52 weeks with commits |
| 16.6/18 | Commit volume — 70 commits in the last year |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Inputs used
| commits_last_year | 70 |
| human_commit_share | 1 |
| days_since_last_push | 10 |
| active_weeks_last_year | 5 |
Release discipline
83Good
How it's scored
| 27/27 | Ships releases — 2 releases published |
| 36/36 | Release recency — latest release 10 days ago |
| 19.8/27 | Release cadence — a release every ~58.2 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases. |
Inputs used
| releases_count | 2 |
| latest_release_tag | v1.1.0 |
| releases_from_tags | no |
| days_since_latest_release | 10 |
| mean_days_between_releases | 58.2 |
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
29
Popularity & adoption
11Critical
How it's scored
| 11.3/60 | Stars — 6 stars |
| 0/25 | Forks — 1 forks |
| 0/15 | Watchers — 0 watchers |
Inputs used
| forks | 1 |
| stars | 6 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
50Moderate
How it's scored
| 22.5/22.5 | README |
| 22.5/22.5 | License — recognized license (MIT) |
| 0/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | yes |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
28
Maintainer resilience (bus factor)
10Critical
How it's scored
| 9/54 | Bus factor — 1 contributor(s) cover half of all commits |
| 0/22.5 | Commit distribution — top contributor authored 100% of commits |
| 1.4/13.5 | Contributor breadth — 1 contributors |
| 0/10 | OpenSSF Scorecard: Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
Inputs used
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Issue & PR responsiveness
38At risk
How it's scored
| 0/46.8 | Issue resolution — 0% of issues closed |
| 38.2/38.3 | PR acceptance — 45/45 decided PRs merged |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Inputs used
| merged_prs | 45 |
| open_issues | 1 |
| closed_issues | 0 |
| issue_closed_ratio | 0 |
| closed_unmerged_prs | 0 |
Ownership & stewardship
40At risk
How it's scored
| 10/30 | Ownership backing — personal (user) account |
| 0/20 | Verified domain — not applicable to user accounts |
| 10.1/25 | Owner reach — 24 followers of bugsyhewitt |
| 12.2/25 | Track record — 40 public repos, account ~0 yr old |
Inputs used
| followers | 24 |
| owner_type | User |
| is_verified | — |
| owner_login | bugsyhewitt |
| public_repos | 40 |
| account_age_days | 84 |
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.
Engineering Quality
Are baseline engineering and documentation practices in place?
72
Engineering practices
70Good
How it's scored
| 24/24 | CI workflows — 2 workflow(s) |
| 24/24 | Tests present |
| 16/16 | Linter config — .golangci.yml |
| 0/9.6 | Pre-commit hooks |
| 6.4/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — 0 out of 26 merged PRs checked by a CI test -- score normalized to 0 |
Inputs used
| has_ci | yes |
| has_tests | yes |
| has_editorconfig | yes |
| has_linter_config | yes |
| has_precommit_config | no |
Documentation
75Good
How it's scored
| 30/30 | README |
| 25/25 | Documentation directory |
| 0/15 | Documentation / homepage site |
| 10/10 | Repository description |
| 0/10 | Topics |
| 10/10 | Wiki |
Inputs used
| topics | — |
| has_wiki | yes |
| homepage | — |
| has_readme | yes |
| has_docs_dir | yes |
| has_description | yes |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
30
Security posture
30At risk
How it's scored
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — 0 out of 26 merged PRs checked by a CI test -- score normalized to 0 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | License — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — Project has not signed or included provenance with any releases. |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 6.8/7.5 | Vulnerabilities — 1 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 18 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 0 |
| scorecard_aggregate | 3 |
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
70
Agent context & guidance
40At risk
How it's scored
| 0/45 | Agent instructions — no CLAUDE.md / AGENTS.md / editor rules |
| 0/15 | Machine-readable docs (llms.txt) |
| 40/40 | Legible commit history — 65 of 70 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.929 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
How it's scored
| 18/18 | One-command bootstrap — Makefile |
| 22/22 | Automated tests |
| 11/11 | Lint / format config — .golangci.yml |
| 11/11 | Static type checking — Go (statically typed) |
| 10/10 | Reproducible environment — lockfile |
| 10/10 | Demonstrated agent practice — 36 of the last 70 commits agent-authored or agent-credited |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | go.sum |
| has_dockerfile | no |
| typed_language | yes |
| bootstrap_files | Makefile |
| has_devcontainer | no |
| has_linter_config | yes |
| typecheck_configs | — |
| agent_commit_share | 0.514 |
| toolchain_manifests | go.mod |
| dependency_bot_commit_share | 0 |
Code legibility for models
100Excellent
How it's scored
| 45/45 | Type-checkable code — Go (statically typed) |
| 55/55 | Manageable file sizes — 0/111 source files over 60KB |
Inputs used
| primary_language | Go |
| largest_source_bytes | 50,908 |
| source_files_sampled | 111 |
| oversized_source_files | 0 |
Key facts
6GitHub stars
1contributors
70commits, last 12 months
10days since last push
2releases
1bus factor
1open issues
Gopackage ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- Could not fetch go package 'github.com/unearth-tool/unearth' from its registry
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
More detail
OpenSSF Scorecard 3.0 / 10
3.0aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 0 | CI-Tests | 0 out of 26 merged PRs checked by a CI test -- score normalized to 0 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| 0 | Signed-Releases | Project has not signed or included provenance with any releases. |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 9 | Vulnerabilities | 1 existing vulnerabilities detected |
Direct dependencies 5
| Registry | Package | Version constraint | Manifest |
|---|---|---|---|
| Go | github.com/mark3labs/mcp-go | v0.48.0 | go.mod |
| Go | github.com/spf13/cobra | v1.10.2 | go.mod |
| Go | golang.org/x/time | v0.5.0 | go.mod |
| Go | gopkg.in/yaml.v3 | v3.0.1 | go.mod |
| Go | modernc.org/sqlite | v1.30.2 | go.mod |
All dependencies not collected
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 455,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 876389,
"Makefile": 603
},
"pushed_at": "2026-07-15T23:52:51Z",
"created_at": "2026-05-16T04:13:01Z",
"owner_type": "User",
"updated_at": "2026-07-15T23:52:55Z",
"description": "Unearth the buried origin IP lurking behind Cloudflare, CloudFront, and other CDN veils. It unleashes 10 passive and active recon rituals in parallel, then weighs each suspect by cross-technique agreement and marks the strongest leads with confidence scores. No API keys required; Censys and Shodan crack open deeper graves if you dare.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "v3x.tech",
"name": "Bugsy Hewitt",
"type": "User",
"login": "bugsyhewitt",
"company": null,
"location": null,
"followers": 24,
"avatar_url": "https://avatars.githubusercontent.com/u/281210152?v=4",
"created_at": "2026-05-02T16:01:55Z",
"is_verified": null,
"public_repos": 40,
"account_age_days": 84
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-07-15T08:30:11Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2026-05-18T03:25:03Z"
}
],
"recent_commits": [
{
"oid": "c0c546ca5dc5433cba621e35ef0e3b694b5164b3",
"body": "…ig_test\n\ngofmt: txtleak.go, otxpdns.go, config_test.go (missed by prior lint pass;\ntxtleak.go and config_test.go were touched by the simplify sweep).\n\nSA1019: CensysAPIID/CensysAPISecret are deprecated-but-kept fields (their own\ndocstrings say 'a later cleanup packet will remove it'). Add a scoped\ngolangci exclusion for SA1019 in pkg/config/config_test.go rather than\npeppering the test file with nolint directives.\n\nBuild and vet verified clean.",
"is_bot": false,
"headline": "fix(lint): gofmt remaining files, suppress intentional SA1019 in conf…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T23:52:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0a60ab3185c3206b39fbfba6fa3f1ab10ed719e8",
"body": "gofmt: re-format root.go, output.go, cli_test.go (tabs/whitespace drift).\n\nstaticcheck S1008 (cdn.go): simplify trailing if/return-true/return-false\npatterns in isGcoreHeaders and isEdgioHeaders to a direct return expression.\n\nrevive redefines-builtin-id (emailheader.go): rename local const max→maxL\n[…]\nr \"passivedns\"\nwhich the misspell tool incorrectly treats as a misspelling of \"passives\";\npassivedns is an established domain compound used throughout the suite.\n\nBuild and vet verified clean locally.",
"is_bot": false,
"headline": "fix(lint): resolve all pre-existing golangci-lint failures",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T23:50:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "83df52656f3151ed506b8ccd45eca47fd1e98bb4",
"body": "…, knownTechniques\n\n- Move publicOriginAddr (txtleak.go) to isPublicOriginAddr in helpers.go,\n the shared helper location; eliminates a third copy of the same private-\n address classifier alongside isPrivateAddr (emailheader) and isUnroutable\n (errorpage).\n- Extract techHitNames helper in output.\n[…]\na manual entry here to\n avoid spurious unknown-technique warnings.\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "simplify(unearth): quality sweep — dedup address filter, techHitNames…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T22:36:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7061802bb83295f25a8b8e04f589817b52f38537",
"body": null,
"is_bot": false,
"headline": "docs: add comic card image to README header",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T21:16:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fcd073e19e511008d4bdaf3f708b441bcee429f4",
"body": "…, knownTechniques (#45)\n\n- Move publicOriginAddr (txtleak.go) to isPublicOriginAddr in helpers.go,\n the shared helper location; eliminates a third copy of the same private-\n address classifier alongside isPrivateAddr (emailheader) and isUnroutable\n (errorpage).\n- Extract techHitNames helper in o\n[…]\na manual entry here to\n avoid spurious unknown-technique warnings.\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "simplify(unearth): quality sweep — dedup address filter, techHitNames…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T19:16:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b9caf8c1c95ebaa7fdded6ae9ae98803e0b24a61",
"body": "* release: cut v1.1.0\n\nBumps version string from 0.1.0-dev to 1.1.0 and promotes the\n[Unreleased] CHANGELOG section to [1.1.0] (2026-07-15).\n\nv1.0.0 was tagged at the initial release (2026-05-17, commit bef8eaf).\nThe 45 subsequent commits added 20 new discovery techniques (greynoise_asset,\notx_passi\n[…]\nchnique, --pipeline-batch, calibrate\nsubcommand, and several credential-env and favicon-hash bug fixes. All\n10 test packages pass with -race.\n\n* chore: add v1.1.0 release output.md and test-output.txt",
"is_bot": false,
"headline": "v1.1.0 release (#44)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T08:30:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "efe4c5c222cb0933815d6bf5da05eeabf7ebabcc",
"body": "…run (#43)\n\nAdds --exclude-technique <name>[,<name>...] (repeatable StringSlice flag)\nto the CLI and ExcludeTechniques []string to unearth.Options. Unknown names\nproduce a Warnings entry rather than a hard error. 7 new tests across the\nengine and CLI packages; all 10 packages pass under -race.",
"is_bot": false,
"headline": "feat(cli): add --exclude-technique flag to skip named techniques per …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T07:49:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03a1a4a80617abd43833bd752cea42f449f1200a",
"body": "Hide candidates below a supplied score threshold across all four output\nformats (jsonl, json, table, sarif). Default 0 = show all (no change to\nexisting behaviour). Validates range [0.0, 1.0] at parse time.\n\nFiles changed:\n- cmd/unearth/internal/cli/root.go: new flag + validation\n- cmd/unearth/inter\n[…]\nw tests\n- cmd/unearth/internal/cli/extra_test.go: TestFilterByConfidence unit test\n- README.md: document flag in CLI reference and quick-start\n\nAll 10 packages pass under go test ./... -count=1 -race.",
"is_bot": false,
"headline": "feat(cli): add --min-confidence threshold filter (#42)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T06:48:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7822855166fc417da593a764562e0591d9f99bf8",
"body": "…integration (#41)\n\nAdd `-o sarif` output format that emits a SARIF 2.1.0 document with one\nresult per candidate IP. Each result carries rule UNEARTH001, a level\nderived from the confidence score (error ≥0.80, warning ≥0.50, note\n<0.50), a logicalLocation of the target domain, and a properties bag\nw\n[…]\n cap, multi-target\naggregation, and the sarifLevel helper directly.\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(output): add SARIF 2.1.0 output format for GitHub Code Scanning …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T06:27:58Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b013cc4484bc3674aeaf191f40b68f06d7bf3724",
"body": "… and CredentialStatus coverage (#40)\n\nFive credential sets (ZoomEye, Chaos/PDCP, VirusTotal, URLScan, GreyNoise)\nwere missing from allCredentialEnvVars in pkg/config/config_test.go. Tests\ncalling clearCredentialEnv did not clear these vars, so a real GREYNOISE_API_KEY\n(for example) in a CI shell co\n[…]\nnd expand the brief technique list to name JARM and ASN-range sweep\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test(config): fix credential env-isolation gap; extend canonical-name…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T06:10:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3925e9302fe2e3fb24deabdd202cc13147cf26d0",
"body": "…n_hash pre-filter bug (#39)\n\nSeven techniques shipped after v1.0 (split_dns, email_header, jarm_fingerprint,\nasn_sweep, shodan_cve, favicon_hash, dns_txt_leak) were never added to\nknownTechniques or the default-weights YAML files, so users who tried to\noverride their weights received spurious \"unkn\n[…]\nKeyFor_FaviconHash, TestHasKeyFor_AllKeyRequiringTechniquesCovered.\n\n\nClaude-Session: https://claude.ai/code/session_01QHhuEAy81RAFs7Rp9jWRFd\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(config): wire post-v1.0 techniques into config system; fix favico…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T05:42:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8014c2f37baa2ad4b71f1e5099f562eff225a35b",
"body": "…38) (#38)\n\nThree new tools in unearth-mcp give AI agents low-overhead introspection\nand filtering capabilities without running a full discovery pipeline:\n\n- unearth_check_cdn: CDN fingerprinting for a hostname using the same\n DNS/IP-range/header detection as the discovery engine; surfaces the\n CD\n[…]\nded to cmd/unearth-mcp/main_test.go; all pass.\nMCP server grows from five to eight tools. POST_V01.md updated to mark\nP2 FOFA/Netlas/CriminalIP, P3 pipeline-batch, and P3 MCP expansion as\nimplemented.",
"is_bot": false,
"headline": "feat(mcp): add check_cdn, is_cdn_ip, list_techniques utility tools (#…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T04:05:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2a581744429eea498b5fcfc04f013cd008a74bda",
"body": "…hnique (#37)\n\n- Implement JARM 10-probe active technique in pkg/techniques/jarm.go; self-\n contained pure-Go port of the Salesforce JARM algorithm with no new external\n dependency (no jarm-go module required).\n- Weight corrected to 0.80 per spec (was 0.70); all 12 unit tests updated.\n- Known CDN-\n[…]\nws from RunOptions.SeedIPs like host_header.\n- README techniques table updated: weight 0.70 → 0.80.\n- POST_V01.md: P2 jarm_fingerprint section marked ✅ IMPLEMENTED with\n implementation summary block.",
"is_bot": false,
"headline": "feat(techniques): ship jarm_fingerprint active TLS fingerprinting tec…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T02:43:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "84b0724af806769bc431dd2a39c6ec5eeb9fd429",
"body": "Both techniques shipped in prior laps (f22984b / 6bb8904) but\nPOST_V01.md was not updated with the ✅ IMPLEMENTED markers.",
"is_bot": false,
"headline": "docs(POST_V01): mark asn_sweep and split_dns as implemented (#36)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-07-15T02:10:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34a205f4da98dd2874bf91d95a0ee588ad938b5c",
"body": "…e (necro-phase2-r1) (#34)\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(unearth): add dns_txt_leak passive TXT-record origin-IP techniqu…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-06-05T19:20:19Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7c21ac76218e5040c6ab675cb7b2e316b0acee43",
"body": "Add two widely-used CDN providers that were previously missing from the\nfilter, causing Vercel- and Netlify-hosted origins to appear as unfiltered\ncandidates in scan results.\n\n- Embed IPv4/IPv6 CIDR ranges for Vercel (AS13335-edge) and Netlify (AS137954)\n- Add buildVercel()/buildNetlify() with canon\n[…]\nproviders in init() after cachefly\n- 22 new tests: IP range, DNS hint, and header detection for both providers\n\nCloses #36\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(cdn): add Vercel Edge Network and Netlify CDN providers (#33)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-06-05T15:02:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "32920fa2b85bb0092210cdfc5c8b5da4954107d5",
"body": "…#32)\n\nAdds greynoise_asset, the 17th asset-discovery technique, querying\nGreyNoise's GNQL search for IPs whose rDNS or organization metadata\nself-advertises under the target apex. A sensor-observed-noise pivot\northogonal to every existing backend: the IP must be currently live\n(GreyNoise sensors ob\n[…]\nufficient). Pagination via scroll cursor with a\n10-page ceiling. Results cached 1h.\n\nCo-authored-by: unearth-worker <worker@necromancer.local>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add greynoise_asset sensor-observed-noise backend (…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T04:19:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e7afe2d1110bf7075f6006cf8437d8ac7c8ba70f",
"body": "Sixteenth asset-discovery backend. Inverts shodan_cert's signal: rather\nthan requiring the candidate host to reuse the front-door TLS\ncertificate, it requires the candidate host to expose a specific known\nvulnerability. Given an operator-supplied CVE id (--cve flag) and the\ntarget apex, queries Shod\n[…]\ndates) mirroring\nthe email_header operator-supplied-scope idiom.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add shodan_cve discovery technique (#31)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T03:22:53Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "02e371b2563e1816e69698e5c4758b430bd13c76",
"body": "Adds the fifteenth asset-discovery backend, intentionally orthogonal to\ncensys_cert. Where censys_cert pivots on the target's TLS leaf-certificate\nSHA-256 (and so only surfaces hosts that reuse the front-door certificate),\ncensys_ipv6 pivots on the target's DNS apex via the Censys Platform\nhost.dns.\n[…]\nGELOG.md unreleased entry added\n\nTest suite: go test ./... — all packages pass.\n\nCo-authored-by: unearth-worker-r33 <worker@necromancer.local>\nCo-authored-by: Claude Sonnet 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add censys_ipv6 IPv6 asset-discovery backend (#30)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T02:06:01Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "31671cb0a338bd495a11abc303bc5e4ead689d30",
"body": "… backend (#29)\n\nThe fourteenth asset-discovery backend. AlienVault OTX passive-DNS\nqueries (GET /api/v1/indicators/domain/{domain}/passive_dns) surface\nhistorical hostname-to-IP observations from OTX's honeypot/sensor\nnetwork, community-submitted analyst pulse feeds, and partner DNS\ntelemetry. Diff\n[…]\ny update\n- docs/techniques.md detailed section\n- CHANGELOG entry\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add otx_passivedns keyless threat-intel passive-DNS…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T00:43:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1f86d032b239554beb4d9b1e70f82e3f99459f9b",
"body": "…end (#28)\n\nShips the 13th OSINT asset-discovery backend, urlscan_asset (passive tier,\nweight 0.66). Like fullhunt_asset, zoomeye_asset, chaos_asset, and\nvirustotal_passivedns -- and unlike the eight cert-fingerprint engines --\nthis is not a cert pivot. It queries URLScan.io's /api/v1/search/ endpoi\n[…]\nonfigs/default-weights.yaml so the embed-vs-source guard passes.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add urlscan_asset browser-scan asset-discovery back…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-30T00:28:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "82854303166a405e06437a1773891457719c3f3e",
"body": "…end (#27)\n\nThe twelfth asset-discovery backend, and the fourth non-cert-pivot enumerator\nalongside fullhunt_asset, zoomeye_asset, and chaos_asset. Queries VirusTotal's\nv3 /domains/{domain}/resolutions endpoint for every historical hostname->IP\nobservation in its passive-DNS corpus and emits the non\n[…]\nrsor pagination.\nFull suite green with -race: 538 passing tests.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add virustotal_passivedns temporal passive-DNS back…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T22:14:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f92b6ebe9ad61699556fe47a99e65db5886f395b",
"body": "…nd (#26)\n\nThe eleventh asset-discovery backend and the eighth independent\ncertificate-pivot engine. The two backends originally suggested for this\nslot — BinaryEdge and LeakIX — were already shipped (`binaryedge_cert`\n0.72 and `leakix_cert` 0.71). Onyphe (onyphe.io) was selected as the\nnext-best un\n[…]\nboration weight pending\ncalibration.\" The calibrate subcommand will refine this weight from\nreal-world corroboration data.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(techniques): add onyphe_cert EU-weighted certificate-pivot backe…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T21:10:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "56510424d664861df6529d28d08246e774691273",
"body": "…backend (#25)\n\nAdd chaos_asset, the tenth asset-discovery backend, querying ProjectDiscovery's\nChaos dataset (the corpus behind subfinder). Verified neither Mercury/Chaos nor\nCensys Communities was already shipped; Censys Communities was rejected as too\nclose to the shipped censys_cert (Censys Plat\n[…]\nHANGELOG.\n\ngo test -race ./... is green; go vet and gofmt clean.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add chaos_asset ProjectDiscovery subdomain-dataset …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T20:11:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4118cb60da668123f0c431df57b3ea969b773e6e",
"body": "…tion backend (#24)\n\nAdds ZoomEye as the ninth passive recon backend (passive tier, weight 0.68).\nLike fullhunt_asset, and unlike the seven cert-fingerprint engines, this is a\ndomain host enumerator rather than a cert pivot: it queries ZoomEye's\ndomain-search API for the associated hosts crawled und\n[…]\nys section, and explanatory\nnote updated; CHANGELOG entry added.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add zoomeye_asset APAC-coverage domain host-enumera…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T19:08:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3e98560b419245900793bb2511dcc5071bd7c16c",
"body": "…backend (#23)\n\n* feat(techniques): add leakix_cert SHA-1 certificate-fingerprint pivot\n\nAdd LeakIX (leakix.net) as the seventh independent cert-pivot backend,\nalongside censys/shodan/fofa/netlas/criminalip/binaryedge. It fingerprints\nthe target's TLS leaf cert (SHA-1, the Shodan/BinaryEdge flavor) \n[…]\nuthored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add fullhunt_asset attack-surface host-enumeration …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T18:05:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "17bb8f0830cff42e0769992d9011bde3948fe92a",
"body": "…ivot (#22)\n\nAdd BinaryEdge as a sixth independent certificate-pivot backend alongside\ncensys_cert, shodan_cert, fofa_cert, netlas_cert, and criminalip_asset.\nbinaryedge_cert (passive, weight 0.72) fingerprints the target's TLS leaf\ncert SHA-1 and queries the BinaryEdge host-search API for every sca\n[…]\nalip previously fell to\nthe default false branch and never ran).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add binaryedge_cert SHA-1 certificate-fingerprint p…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T14:54:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "cd9f40a5808f648a71d780d345e23611fc6966d9",
"body": "The README instructed users to export CENSYS_PLATFORM_PAT, SHODAN_API_KEY,\nSECURITYTRAILS_API_KEY, VIEWDNS_API_KEY, FOFA_EMAIL/FOFA_KEY, NETLAS_API_KEY,\nand CRIMINALIP_API_KEY, but LoadAPIKeys only read the UNEARTH_-prefixed\naliases. Any user following the docs had their keys silently ignored and ev\n[…]\n and documents the\nalias precedence in the README and CHANGELOG.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: honor documented API-key env var names (#21)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T13:36:04Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0073801103a2e6824f919de5d15657d1b67d72c1",
"body": "Add Criminal IP (criminalip.io) as the fifth passive cert-fingerprint\npivot backend alongside censys_cert, shodan_cert, fofa_cert, and\nnetlas_cert. Fingerprints the target's TLS leaf cert (SHA-256) and\nqueries the Criminal IP banner search API for assets presenting the\nsame fingerprint, surfacing no\n[…]\n error\nclassification path) plus a config CredentialStatus test.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add criminalip_asset cert-fingerprint pivot (#20)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T12:35:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a544fcf8d556ae7f6fb1b196197a6aa0fbb19892",
"body": "Add the Netlas (netlas.io) certificate-fingerprint pivot as the next P2\nsearch backend, paralleling censys_cert, shodan_cert, and fofa_cert. It\nfingerprints the target's TLS leaf cert (SHA-256), queries Netlas's response\nindex for hosts sharing the fingerprint, and emits non-CDN hits as origin\ncandi\n[…]\nnto config, default weights (both copies),\ncredential reporting, the CLI status banner, and the MCP cert-fingerprint tool.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(techniques): add netlas_cert certificate-fingerprint pivot (#19)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T11:33:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "98071ddabbfe166ce6ec814326513a025654fec5",
"body": "…h3 (#18)\n\nThe github.com/spaolacci/murmur3 v1.1.0 dependency performs unsafe\npointer arithmetic in Sum32WithSeed that trips Go's -race / checkptr\ninstrumentation (\"checkptr: pointer arithmetic result points to invalid\nallocation\"), crashing the favicon_hash test under the race detector and\nkeeping \n[…]\nependency from go.mod/go.sum.\n\ngo test -race ./... is now green.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(favicon): replace murmur3 dep with pointer-safe pure-Go MurmurHas…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T10:27:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e36caa11427e5ee82e1d5e22da767d1d288ec4ae",
"body": "Add fofa_cert, a passive cert-fingerprint pivot technique that queries\nFOFA (fofa.info) for hosts presenting the target's TLS leaf-cert SHA-256,\nmirroring the existing censys_cert / shodan_cert pattern. FOFA's 4B+ asset\nindex has substantially heavier APAC scan coverage than the US-centric\nShodan an\n[…]\nappy path,\nboth-keys-required skip, empty/quota/bad-cred/403/generic-error/malformed\npaths, port stripping, and metadata).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(techniques): add fofa_cert FOFA certificate-fingerprint pivot (#17)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T09:28:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "be7bd3cab470e8128c5433bc6d18fe7a8bf731bd",
"body": "Adds CacheFly to the CDN provider registry so its edge IPs are filtered\nout of origin-candidate lists and surfaced as a recognized CDN.\n\nDetection signals (all non-colliding with existing providers):\n- IP ranges: AS30081 blocks (205.234.0.0/19, 204.93.150.0/23,\n 204.93.157.0/24, 2620:e6::/32). The \n[…]\nThe TestNoDuplicatePrefixAcrossProviders\ncollision guard passes.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add CacheFly (CacheNetworks) provider detection (#16)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T08:15:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "860de2bdce36fdaa027c9398d0e216e721d7f3c7",
"body": "Add Gcore (G-Core Labs S.A., AS199524) to the CDN provider registry so\nits edge IPs are filtered from origin candidates instead of polluting\nresults. Detection uses embedded edge ranges, gcdn.co/gcorelabs.com/\ngcore.com CNAME suffixes, the Server: gcore marker, the X-Gcore-* header\nfamily, and an X-\n[…]\nregistry-wide\nTestNoDuplicatePrefixAcrossProviders guard passes.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add Gcore (G-Core Labs) provider detection (#15)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T07:18:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "35fe0665b2f602bf60619c3ed60fd1904fd52c78",
"body": "KeyCDN (proinity GmbH, AS199653) is now a recognized CDN provider, so its\nedge IPs are filtered from origin candidates instead of polluting results.\nDetection uses embedded edge ranges, the kxcdn.com/keycdn.com CNAME\nsuffixes, the Server: keycdn-engine marker, X-Edge-Location and X-Pull\nheaders, and\n[…]\nCDN-\nexclusive; the registry-wide duplicate-prefix guard passes.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add KeyCDN provider detection (#14)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T06:15:40Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d07ddc47be477e22738ae525b79e3a37d2c770e4",
"body": "Edgio — the 2022 merger of Limelight Networks and Edgecast (Verizon\nMedia) — is the highest-traffic-share enterprise CDN still unmodeled\nafter CDN77. Adding it to the registry stops its edge IPs from polluting\norigin candidates.\n\nDetection is fully self-contained (no API key, no new dependency):\nemb\n[…]\nDME CDN\ncoverage, CHANGELOG, and the POST_V01 landscape summary.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add Edgio (Limelight / Edgecast) CDN detection (#13)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T05:14:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "37c926eecc4f2e13a4b5648b8f6e6b8c772a735f",
"body": "Adds CDN77 as a recognized provider in the CDN registry so its edge IPs\nare filtered from origin candidates instead of polluting results.\n\nDetection mirrors the existing BunnyCDN / StackPath pattern exactly:\nembedded edge IP ranges (AS60068, DataCamp Limited / CDN77 s.r.o.), the\ncdn77.org / cdn77-ss\n[…]\n traffic in that block unreachable. Removed the erroneous entry.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add CDN77 (DataCamp) detection (#12)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T04:06:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e7d3d9dc40afbff956c6640c88bbfb44837f43ff",
"body": "BunnyCDN is now a recognized provider in the CDN registry, so its edge\nIPs are filtered from origin candidates instead of polluting results.\n\nDetection signals:\n- Embedded edge IP ranges (primary ASN AS200325, BunnyWay d.o.o.)\n- b-cdn.net / bunnycdn.com / bunny.net CNAME suffixes\n- Server: BunnyCDN-\n[…]\nor, Google Cloud CDN, and StackPath/Highwinds providers exactly.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add BunnyCDN (bunny.net) detection (#11)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T02:58:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "577af9fab7dcbf9ad7c5d0077bb41a59aeabc385",
"body": "Add StackPath (formerly Highwinds Network Group / NetDNA / MaxCDN) to the\nCDN provider registry so its edge IPs are filtered from origin candidates\ninstead of polluting discovery results.\n\nDetection signals:\n- embedded Highwinds edge ranges (ASNs AS20446 / AS33438)\n- stackpathcdn.com / stackpathdns.\n[…]\n Cloud CDN providers.\n\nTests: 343 -> 348 (cdn package 44 -> 49).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add StackPath/Highwinds CDN detection (#10)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-29T00:05:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "73689ea17aa724dbbec272572f8d7d72c4c7f56a",
"body": "Adds Google Cloud CDN (Google Front End / global external HTTP(S) load\nbalancer) as a recognized provider in the CDN registry so its anycast\nand GFE edge IPs are filtered from origin candidates instead of\npolluting results — the next CDN coverage gap named in POST_V01.md.\n\nDetection signals, mirrori\n[…]\n\nIPv4/IPv6 range matching, DNS hints, and header classification.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add Google Cloud CDN detection (#9)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T23:06:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "55d7ac1ba500f4708fe8820eed95c4299707703b",
"body": "Azure Front Door is now a recognized provider in the CDN registry, so its\nanycast edge IPs are filtered from origin candidates instead of polluting\nresults. Detection uses embedded AzureFrontDoor service-tag ranges, the\nazurefd.net/azureedge.net/t-msedge.net/trafficmanager.net CNAME suffixes,\nthe pr\n[…]\n in the\nPOST_V01 landscape summary alongside Akamai and Imperva.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: add Azure Front Door CDN/WAF detection (#8)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T22:14:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8d2bf40cf631d2a92e29cb0dff6b6b496c803e18",
"body": "Imperva is a top-tier enterprise WAF/CDN that was missing from the CDN\nregistry, so its edge IPs were surfaced as origin candidates by the\ncert- and subdomain-based techniques, polluting results for any\nImperva-fronted target.\n\nAdd it as a provider mirroring the Akamai pattern: embedded edge IP\nrang\n[…]\nCHANGELOG, and POST_V01.md (also marks Akamai coverage shipped).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cdn): add Imperva (Incapsula) CDN/WAF detection (#7)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T21:26:48Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "14468c22bd144c71aaaec2ab0b055d61284f83db",
"body": "…3) (#6)\n\nRecord a per-technique observation after each discovery run — whether the\ncandidate that technique surfaced was corroborated by another technique in\nthe same run — and add `unearth calibrate` to turn that accumulated history\ninto per-technique precision estimates and suggested weight overr\n[…]\nort and\nnever affects discovery; --no-cache runs record nothing.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(calibrate): weight auto-calibration from run history (POST_V01 P…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T20:43:33Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b4b26a3698599718743127d287f6a51d89146b82",
"body": "…(#5)\n\nImplements the P3 \"Bulk target parallelism (pipeline mode)\" direction from\nPOST_V01.md. List/stdin runs previously processed targets strictly one at a\ntime, which is slow for large subdomain pipelines (subfinder | unearth -l -).\n\n--pipeline-batch <n> runs discovery across a bounded worker poo\n[…]\n, batch-size clamping,\nand invalid-batch validation. Race-clean.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cli): add --pipeline-batch for concurrent bulk-target discovery …",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T19:59:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8745581042b3510516788827bbe70517c3a682e3",
"body": "…g (#4)\n\nAdds the email_header technique (passive tier, weight 0.85), the\nhighest-ranking unimplemented POST_V01 item that needs no external API\nkey. Parses an operator-supplied raw email via net/mail, walks the\nReceived: header chain, and surfaces public non-CDN relay IPs as origin\ncandidates — mai\n[…]\n SMTP-probe variant is\ndeferred (needs operator infrastructure).\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add email_header passive .eml Received-header minin…",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T19:04:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "48b11092474368fb9de50a29ae2614fc050be7d6",
"body": "Implements the Salesforce JARM active server-fingerprinting method as a\nself-contained pure-Go technique (no external module dependency). It\nsends ten crafted TLS ClientHello probes to each phase-1 candidate IP,\nfolds the handshake responses into a 62-character fingerprint, and flags\ncandidates whos\n[…]\ning/ServerHello-parsing internals\noffline, with no live network.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "add jarm_fingerprint active TLS fingerprinting technique (#3)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T12:48:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6bb8904ecb78934af56216b280787fb924a34305",
"body": "Detects split-DNS / partial-proxy misconfigurations where only the www\nhostname is routed through a CDN while the apex or a mail/admin sibling\nis left in DNS-only mode pointing straight at the origin. Resolves apex\nand www to establish a CDN-fronted front door, then flags non-CDN IPs on\nthe apex and\n[…]\nentials, so the highest-ranked keyless item was shipped instead.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add split_dns partial-proxy origin detection (#2)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-28T12:00:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fe60d0ebc9afdd670a9818e034f548da287e64b0",
"body": null,
"is_bot": false,
"headline": "feat: Akamai CDN detection — IP ranges, CNAME suffixes, response headers",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-27T02:52:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f22984b2dede8f5269f1ff568dfedee001bc7dde",
"body": null,
"is_bot": false,
"headline": "feat: asn_sweep technique — BGPView ASN-range origin discovery",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-27T01:47:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a641747723af54a0b3160f80e0a3f66104952c4c",
"body": "Fetch the target's /favicon.ico (HTTPS with HTTP fallback), compute its\nMurmurHash3 using Shodan's convention -- mmh3(base64.encodebytes(bytes))\nas a signed int32 -- and query Shodan (http.favicon.hash) and/or Censys\n(services.http.response.favicons.hashes) for hosts sharing that favicon.\nNon-CDN hi\n[…]\nrt) miss.\nEither API key alone is sufficient; with neither configured the\ntechnique skips gracefully, matching the existing keyed techniques.\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(techniques): add favicon_hash origin-discovery technique",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-26T23:34:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fdb0db7bed326ab466a4a821ae2907d5dbaa90fc",
"body": "Research lap covering CDN bypass and origin-discovery landscape through\nmid-2026. Ranks 9 improvement areas (P1-P4) by signal-to-effort ratio:\nfavicon hash pivoting, ASN-range sweep, Akamai CDN coverage, FOFA/Netlas\nintegration, JARM fingerprinting, split-DNS detection, email header leak,\npipeline parallelism, and JA4 fingerprinting.\n\nCo-authored-by: bugsyhewitt <281210152+bugsyhewitt@users.noreply.github.com>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "research: add POST_V01.md with ranked post-v1.0 directions (#1)",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-26T18:43:30Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bef8eafcfd9f8d3142b523390dd3a9d46d1882bd",
"body": null,
"is_bot": false,
"headline": "fix: remove invalid changelog.source field from .goreleaser.yaml",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-18T03:23:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03c8a9f34fdc2dafa39b454b887400ebbde10705",
"body": "… workflow, v1.0.0",
"is_bot": false,
"headline": "Packet 7: README, docs (techniques, mcp, ranking), CHANGELOG, release…",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-18T02:54:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6bf5a19417feded253bd4f23f9cfab411ff209cc",
"body": "… (Fastly, Sucuri)",
"is_bot": false,
"headline": "Packet 6: MCP server (5 tools, stdio transport) + CDN dataset upgrade…",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-18T02:46:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e964cbc672f936fc83eec91d5b83a0644241974",
"body": null,
"is_bot": false,
"headline": "Packet 5B: add report and create docs/reports directory",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-18T02:28:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e0c147136c1558f341f1e738c2246d11fa846911",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Bugsy Hewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-17T14:36:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7ca26b96a76b65daff76791708afac286d1dbe19",
"body": null,
"is_bot": false,
"headline": "chore: nudge GitHub contributor-stats cache",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-17T14:04:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed034e60cfe4ce18e34b8ef89141df7b5016b909",
"body": "Adds the keyless cert-pivot capability that makes the free tier\nuseful, hardens the existing crt.sh path, and gives slow techniques\ntheir own timeout budget.\n\nct_fingerprint (passive, no key, weight 0.70):\n- Backend A: kaeferjaeger.gay/sni-ip-ranges streaming download of\n five provider files (amazo\n[…]\n\nCoverage: pkg/techniques 83.9% (up from 82.4%), pkg/unearth 84.4%\n(up from 83.9%). No regression. e2e keyless run against example.com\nnow returns 62k candidates in 67s — meaningful free-tier results.",
"is_bot": false,
"headline": "Packet 5B: ct_fingerprint, crtsh hardening, per-technique timeouts",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T23:01:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f4001831d097f2839d5f816503ec4a1dc02834e9",
"body": "Adds five new techniques and the two-phase orchestration model they\nneed to be useful:\n\n- shodan_cert (active, 0.85) — TLS leaf-cert SHA-1 fingerprint\n pivoting via the Shodan /shodan/host/search endpoint, with the\n same tier_insufficient handling as censys_cert.\n- host_header (active, 0.85, consu\n[…]\nmat) while\ncensys_cert keeps SHA-256 — both share one dial via leafCertDER.\n\nCoverage: every new technique file ≥ 76%; package totals climb to\ntechniques 82.4%, unearth 83.9%; no regression elsewhere.",
"is_bot": false,
"headline": "Packet 5A: active & aggressive techniques + phased engine",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T21:03:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d801c0f67ffb9591a8bfa879a078f3a59dccd565",
"body": null,
"is_bot": false,
"headline": "lint: gofmt tty.go after removal of unused type",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:23:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1999bb90488b3414d579605e548df0b4aec7aceb",
"body": null,
"is_bot": false,
"headline": "lint: rename shadowing 'cap', drop unused discardTTY",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:22:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c2e87a489daa5fa4b75b0211f015c58d9db44b3a",
"body": "Adds the real unearth CLI in cmd/unearth/internal/cli, replacing the\nstub. main.go is thin: it calls cli.Run with os streams and exits with\nthe returned code. The package implements:\n\n- Root command running discovery on a single target, a -l <file>, or\n piped stdin (precedence in that order; ignore\n[…]\nes\n unwind cleanly.\n\nAlso adds an optional WeightsPath field to unearth.Options so --weights\nthreads through to config.LoadWeights (small additive change to the\nlibrary API authorized by the packet).",
"is_bot": false,
"headline": "Packet 4 Part C: CLI with cobra, three output formats, cache subcommands",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:20:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4feb632dcb7860697a30e7236480526ecc37a0ff",
"body": "The Censys Search v2 API is disabled for Free accounts and is being\nsunsetted in 2026; the legacy ID+secret pair no longer authenticates\nagainst any endpoint we can call. Move censys_cert to the Censys\nPlatform API:\n\n- POST https://api.platform.censys.io/v3/global/search/query with\n CenQL body host\n[…]\nas missing.\n- Tests rewritten: Bearer header asserted, search body parsed and\n validated, multi-page pagination exercised, empty/missing-PAT/\n budget-exhausted/HTTP-error/malformed-JSON all covered.",
"is_bot": false,
"headline": "censys_cert: migrate to the Censys Platform API",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:13:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b9ceede28b39e642b1b0110b0ec93f90dc342a10",
"body": null,
"is_bot": false,
"headline": "lint: wrap remaining deferred Body.Close in errcheck-friendly closure",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:05:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75a8321837029037b0431311a524ece6129e0772",
"body": "Wrap deferred Close() calls in errcheck-friendly closures, rename the\n'cap' identifier that shadowed the builtin, suppress unused-parameter\nwarnings on test/handler arguments that genuinely are unused, add a\njustifying comment to the modernc.org/sqlite blank import, and convert\na switch-true into a tagged switch per staticcheck QF1002.",
"is_bot": false,
"headline": "lint: fix errcheck, revive, and staticcheck findings",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:04:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f48a2e0e4c47ef7418a93eab2909d6c87b4865c2",
"body": null,
"is_bot": false,
"headline": "ci: bump golangci-lint-action to v7 for v2 support",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T20:00:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d3fe7a4d5f2a3ceb3d6a717c77d1c39b405aaef4",
"body": "Adds:\n- pkg/cdn: Cloudflare + CloudFront detection (DNS, headers, IP range\n match) with embedded range snapshots (2026-05-16) and a Refresh()\n hook for fetching fresh ranges.\n- internal/httpclient: shared HTTP client with tuned timeouts, redirect\n cap, TLS config, and User-Agent stamping.\n- Five \n[…]\ne.com, surfaces 2\n crt.sh candidates).\n\nCoverage: cdn 87.3%, techniques 78.3%, unearth 83.2%, httpclient 100%,\ncache 86.2%, config 92.9%, ratelimit 96.2%. CGO_ENABLED=0 builds\nclean. Race tests pass.",
"is_bot": false,
"headline": "Packet 3: passive techniques, CDN detection, orchestration engine",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T12:35:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f6e86ad05bbe021671927563c4d85a85aa6bba0b",
"body": "Bump Go floor from 1.22 to 1.23 in go.mod and README (dep graph requires\nit), pin CI Go to 1.23 on test/vet/lint, keep build matrix on stable.\nMigrate .golangci.yml to v2 schema (file shipped with Packet 3) and bump\nCI lint pin to golangci-lint v2.12.2.",
"is_bot": false,
"headline": "Packet 3 prep: Go floor and lint config",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T12:15:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a9f1ae86c9be10a3c3b268149594bc7a126da59",
"body": "Implements pkg/config (YAML weights w/ embedded defaults + XDG override,\nAPI key loading from env, credential status helper), pkg/cache (pure-Go\nmodernc.org/sqlite with WAL, deterministic Key(), TTL eviction, Purge,\nStats) and internal/ratelimit (per-key x/time/rate token buckets and a\nconcurrent-safe Budget for paid-API caps). All three satisfy the\ninterfaces declared in pkg/techniques. Coverage: config 92.9%, cache\n86.2%, ratelimit 96.2%. Builds clean with CGO_ENABLED=0; race tests pass.",
"is_bot": false,
"headline": "Packet 2: config loader, SQLite cache, rate limiter & budget",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T10:18:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7c8213f940c6c9cf0e4a519ec057ccc9cce7188a",
"body": null,
"is_bot": false,
"headline": "Initial scaffold: project structure, core types, ranking engine",
"author_name": "bugsyhewitt",
"author_login": "bugsyhewitt",
"committed_at": "2026-05-16T06:54:20Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 2,
"commits_last_year": 70,
"latest_release_at": "2026-07-15T08:30:11Z",
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_last_push": 10,
"active_weeks_last_year": 5,
"days_since_latest_release": 10,
"mean_days_between_releases": 58.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": []
},
"popularity": {
"forks": 1,
"stars": 6,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-07-08",
"count": 1
}
],
"complete": true,
"collected": 1,
"total_forks": 1
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 50908,
"source_files_sampled": 111,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/mark3labs/mcp-go",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.48.0"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "golang.org/x/time",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.5.0"
},
{
"name": "gopkg.in/yaml.v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.0.1"
},
{
"name": "modernc.org/sqlite",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.30.2"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 45,
"open_issues": 1,
"closed_ratio": 0,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "bugsyhewitt",
"commits": 70,
"avatar_url": "https://avatars.githubusercontent.com/u/281210152?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"release.yml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 26 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "c0c546ca5dc5433cba621e35ef0e3b694b5164b3",
"ran_at": "2026-07-26T02:38:57Z",
"aggregate_score": 3,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-15T23:53:56Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-15T22:36:50Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 35,
"created_at": "2026-07-03T02:32:19Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/bugsyhewitt/unearth",
"host": "github.com",
"name": "unearth",
"owner": "bugsyhewitt"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 45,
"inputs": {
"security": 30,
"vitality": 63,
"community": 29,
"governance": 28,
"engineering": 72
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 63,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "at_risk",
"name": "Development activity",
"note": null,
"notes": [],
"value": 49,
"inputs": {
"commits_last_year": 70,
"human_commit_share": 1,
"days_since_last_push": 10,
"active_weeks_last_year": 5
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 10 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "5/52 weeks with commits",
"points": 3.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 5
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "70 commits in the last year",
"points": 16.6,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 70
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "good",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 83,
"inputs": {
"releases_count": 2,
"latest_release_tag": "v1.1.0",
"releases_from_tags": false,
"days_since_latest_release": 10,
"mean_days_between_releases": 58.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "2 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 2
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 10 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~58.2 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 58.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 29,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 11,
"inputs": {
"forks": 1,
"stars": 6,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "6 stars",
"points": 11.3,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 6
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "1 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 1
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "critical",
"name": "Sustainability & Governance",
"value": 28,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "at_risk",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 38,
"inputs": {
"merged_prs": 45,
"open_issues": 1,
"closed_issues": 0,
"issue_closed_ratio": 0,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "0% of issues closed",
"points": 0,
"status": "missed",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 0
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "45/45 decided PRs merged",
"points": 38.2,
"status": "met",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 45,
"decided": 45
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 40,
"inputs": {
"followers": 24,
"owner_type": "User",
"is_verified": null,
"owner_login": "bugsyhewitt",
"public_repos": 40,
"account_age_days": 84
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "24 followers of bugsyhewitt",
"points": 10.1,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 24,
"login": "bugsyhewitt"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "40 public repos, account ~0 yr old",
"points": 12.2,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 40
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 72,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 6.4,
"status": "met",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 26 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 30,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": null,
"notes": [],
"value": 30,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 18,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 0,
"scorecard_aggregate": 3
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 26 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 70,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.929,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "65 of 70 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 65,
"sampled": 70
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 82,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0.514,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "36 of the last 70 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 36,
"sampled": 70
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 50908,
"source_files_sampled": 111,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/111 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 111,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"Could not fetch go package 'github.com/unearth-tool/unearth' from its registry",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-26T02:39:14.320787Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/b/bugsyhewitt/unearth.svg",
"full_name": "bugsyhewitt/unearth",
"license_state": "standard",
"license_spdx": "MIT"
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics.