Public recordGood
Software health reportschema 0.27.0 · metrics 2.5.0 · 2026-08-01 21:09 UTC
callstackincubator / sniffler
Sniffler sniffs out the E2E tests your changes actually wake up.
callstackincubator/sniffler holds a health index of 65 out of 100, placing it in the Good band. It scores highest on Vitality (68/100) and lowest on Community & Adoption (49/100). It was last updated 9 days ago. A single contributor accounts for most of its recent work.
65
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean, calibrated against the distribution of the public record so bands carry percentile meaning; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At Risk ceiling of 34.
65
Exceptional93-100The record's top tier (≈ top 5%); essentially all checked criteria met
Excellent80-92Strong across the board; minor gaps
Good65-79Healthy; gaps are limited and manageable
Moderate50-64Acceptable with notable gaps; review recommended
Weak35-49Material weaknesses across several areas
At Risk20-34Significant weaknesses; adoption warrants caution
Critical1-19Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
The weighted overall 60 is calibrated to 65 on the published index scale (record calibration 2026-08-02).
Ownership
Callstack IncubatorOrganization
405 followers45 public repossince Jun 2018
This repository is backed by an organization — shared, accountable stewardship that can outlive any single maintainer.
Package ecosystems
| Registry | Package | Version | Downloads / mo | Versions | Last publish | Tags |
|---|---|---|---|---|---|---|
| npm | sniffler | 0.5.0 | 3,343 | 5 | 9 days ago | clie2eimpact-analysisjavascriptmonoreporeact-nativesnifflertypescriptvitest |
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
68
Development activity
47Weak
How it's scored
| 28.8/36 | Push recency — last push 9 days ago |
| 2.8/36 | Commit cadence — 4/52 weeks with commits |
| 15.3/18 | Commit volume — 49 commits in the last year |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Inputs used
| commits_last_year | 49 |
| human_commit_share | 1 |
| days_since_last_push | 9 |
| active_weeks_last_year | 4 |
Release discipline
100Exceptional
How it's scored
| 27/27 | Ships releases — 5 releases published |
| 36/36 | Release recency — latest release 9 days ago |
| 27/27 | Release cadence — a release every ~7.6 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — no data |
Inputs used
| releases_count | 5 |
| latest_release_tag | v0.5.0 |
| releases_from_tags | no |
| days_since_latest_release | 9 |
| mean_days_between_releases | 7.6 |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
49
Popularity & adoption
24At Risk
How it's scored
| 23.5/60 | Stars — 29 stars |
| 0/25 | Forks — 1 forks |
| 0/15 | Watchers — 0 watchers |
Inputs used
| forks | 1 |
| stars | 29 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
70Good
How it's scored
| 22.5/22.5 | README |
| 22.5/22.5 | License — recognized license (MIT) |
| 18/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | yes |
| readme_badges | — |
| has_contributing | yes |
| has_issue_template | no |
| has_code_of_conduct | no |
| readme_badge_services | — |
| has_pull_request_template | no |
Ecosystem adoption (downloads)
59Moderate
How it's scored
| 47/80 | Monthly downloads — 3,343 downloads/month across npm |
| 0/20 | Registry dependents — not reported by this ecosystem |
Inputs used
| packages | sniffler |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 3,343 |
Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
61
Maintainer resilience (bus factor)
15Critical
How it's scored
| 9/54 | Bus factor — 1 contributor(s) cover half of all commits |
| 0.5/22.5 | Commit distribution — top contributor authored 98% of commits |
| 2.7/13.5 | Contributor breadth — 2 contributors |
| 3/10 | OpenSSF Scorecard: Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
Inputs used
| bus_factor | 1 |
| contributors_sampled | 2 |
| top_contributor_share | 0.98 |
How it's scored
| 36/42 | Issue resolution — 86% of issues closed |
| 28.7/30 | PR acceptance — 22/23 decided PRs merged |
| 0/13 | Newcomer PR acceptance — no first-time contributor's PR decided in 30d |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 1/30 approved changesets -- score normalized to 0 |
Inputs used
| merged_prs | 22 |
| open_issues | 1 |
| closed_issues | 6 |
| prs_merged_7d | — |
| prs_decided_7d | — |
| prs_merged_30d | — |
| prs_decided_30d | — |
| issue_closed_ratio | 0.857 |
| closed_unmerged_prs | 1 |
| first_time_authors_30d | — |
| first_time_prs_merged_30d | — |
| first_time_prs_decided_30d | — |
Excluded from scoring (no data or not applicable): newcomer_pr_acceptance. Remaining weights renormalized.
Ownership & stewardship
73Good
How it's scored
| 30/30 | Ownership backing — organization-owned |
| 0/20 | Verified domain |
| 18.8/25 | Owner reach — 405 followers of callstackincubator |
| 24.1/25 | Track record — 45 public repos, account ~8 yr old |
Inputs used
| followers | 405 |
| owner_type | Organization |
| is_verified | — |
| owner_login | callstackincubator |
| public_repos | 45 |
| account_age_days | 2,966 |
Package maintenance
100Exceptional
How it's scored
| 25/25 | Published & resolvable — 1 package(s) on npm |
| 35/35 | Publish recency — latest publish 9 days ago |
| 20/20 | Version history — 5 published versions |
| 20/20 | Not deprecated — active, not deprecated or yanked |
Inputs used
| packages | sniffler |
| ecosystems | npm |
| any_deprecated | no |
| min_days_since_publish | 9 |
Engineering Quality
Are baseline engineering and documentation practices in place?
61
Engineering practices
58Moderate
How it's scored
| 24/24 | CI workflows — 2 workflow(s) |
| 24/24 | Tests present |
| 0/16 | Linter config |
| 0/9.6 | Pre-commit hooks |
| 0/6.4 | .editorconfig |
| 10/20 | OpenSSF Scorecard: CI-Tests — 11 out of 20 merged PRs checked by a CI test -- score normalized to 5 |
Inputs used
| has_ci | yes |
| has_tests | yes |
| has_editorconfig | no |
| has_linter_config | no |
| has_precommit_config | no |
Documentation
65Good
How it's scored
| 30/30 | README |
| 25/25 | Documentation directory |
| 0/15 | Documentation / homepage site |
| 10/10 | Repository description |
| 0/10 | Topics |
| 0/10 | Wiki |
Inputs used
| topics | — |
| has_wiki | no |
| homepage | — |
| has_readme | yes |
| has_docs_dir | yes |
| has_description | yes |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
59
Security posture
49Weak
How it's scored
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 1.2/2.5 | CI-Tests — 11 out of 20 merged PRs checked by a CI test -- score normalized to 5 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 1/30 approved changesets -- score normalized to 0 |
| 0.8/2.5 | Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | License — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 5/5 | Pinned-Dependencies — all dependencies are pinned |
| 2/5 | SAST — SAST tool is not run on all commits -- score normalized to 4 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — no data |
| 7.5/7.5 | Token-Permissions — GitHub workflow tokens follow principle of least privilege |
| 6/7.5 | Vulnerabilities — 2 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 17 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 1 |
| scorecard_aggregate | 4.9 |
Excluded from scoring (no data or not applicable): signed_releases. Remaining weights renormalized.
Dependency advisories
100Exceptional
How it's scored
| 35/35 | Direct dependencies free of known advisories — no direct dependency carries a known advisory |
| 25/25 | Indirect dependencies free of known advisories — no indirect dependency carries a known advisory |
| 0/40 | No advisories left outstanding — no advisory carries a publication date |
Inputs used
| source | osv |
| advisories | 0 |
| affected_packages | 0 |
| assessed_packages | 20 |
| unassessed_packages | 0 |
| affected_by_severity | none |
| direct_affected_packages | 0 |
Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:sniffler@0.5.0 runtime dependency closure — what installing the published package pulls in — 20 packages. Reachability is not analyzed.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight (4%): agent tooling is a real maintenance signal, but a repository with none can still reach 100/100.
63
Agent context & guidance
57Moderate
How it's scored
| 18/45 | Agent instructions — AGENTS.md (stub) |
| 0/15 | Machine-readable docs (llms.txt) |
| 39.2/40 | Legible commit history — 36 of 49 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.735 |
| agent_instruction_files | AGENTS.md |
| agent_instruction_max_bytes | 162 |
Verify loop (build / test / typecheck)
53Moderate
How it's scored
| 0/18 | One-command bootstrap |
| 22/22 | Automated tests |
| 0/11 | Lint / format config |
| 11/11 | Static type checking — tests/fixtures/tsconfig-paths/tsconfig.json, tsconfig.json |
| 10/10 | Reproducible environment — lockfile |
| 0/10 | Demonstrated agent practice — no agent-authored commits among the last 49 |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 10/10 | OpenSSF Scorecard: Pinned-Dependencies — all dependencies are pinned |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | pnpm-lock.yaml |
| has_dockerfile | no |
| typed_language | yes |
| bootstrap_files | — |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | tests/fixtures/tsconfig-paths/tsconfig.json, tsconfig.json |
| agent_commit_share | 0 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
Code legibility for models
100Exceptional
How it's scored
| 45/45 | Type-checkable code — TypeScript (statically typed) |
| 55/55 | Manageable file sizes — 0/117 source files over 60KB |
Inputs used
| primary_language | TypeScript |
| largest_source_bytes | 32,290 |
| source_files_sampled | 117 |
| oversized_source_files | 0 |
Key facts
29GitHub stars
2contributors
49commits, last 12 months
9days since last push
5releases
1bus factor
1open issues
npmpackage ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
More detail
OpenSSF Scorecard 4.9 / 10
4.9aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 5 | CI-Tests | 11 out of 20 merged PRs checked by a CI test -- score normalized to 5 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 1/30 approved changesets -- score normalized to 0 |
| 3 | Contributors | project has 1 contributing companies or organizations -- score normalized to 3 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 10 | Pinned-Dependencies | all dependencies are pinned |
| 4 | SAST | SAST tool is not run on all commits -- score normalized to 4 |
| 0 | Security-Policy | security policy file not detected |
| n/a | Signed-Releases | no releases found |
| 10 | Token-Permissions | GitHub workflow tokens follow principle of least privilege |
| 8 | Vulnerabilities | 2 existing vulnerabilities detected |
Direct dependencies 3
| Registry | Package | Version constraint | Manifest |
|---|---|---|---|
| npm | cac | ^7.0.0 | package.json |
| npm | fast-glob | ^3.3.3 | package.json |
| npm | picomatch | ^4.0.4 | package.json |
All dependencies 122
Full resolved dependency set from the GitHub dependency graph: 5 direct and 117 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
| Registry | Package | Version | Relation |
|---|---|---|---|
| npm | cac | 6.7.14 | direct |
| npm | cac | 7.0.0 | direct |
| npm | fast-glob | 3.3.3 | direct |
| npm | picomatch | 2.3.2 | direct |
| npm | picomatch | 4.0.4 | direct |
| npm | @esbuild/aix-ppc64 | 0.27.7 | indirect |
| npm | @esbuild/android-arm | 0.27.7 | indirect |
| npm | @esbuild/android-arm64 | 0.27.7 | indirect |
| npm | @esbuild/android-x64 | 0.27.7 | indirect |
| npm | @esbuild/darwin-arm64 | 0.27.7 | indirect |
| npm | @esbuild/darwin-x64 | 0.27.7 | indirect |
| npm | @esbuild/freebsd-arm64 | 0.27.7 | indirect |
| npm | @esbuild/freebsd-x64 | 0.27.7 | indirect |
| npm | @esbuild/linux-arm | 0.27.7 | indirect |
| npm | @esbuild/linux-arm64 | 0.27.7 | indirect |
| npm | @esbuild/linux-ia32 | 0.27.7 | indirect |
| npm | @esbuild/linux-loong64 | 0.27.7 | indirect |
| npm | @esbuild/linux-mips64el | 0.27.7 | indirect |
| npm | @esbuild/linux-ppc64 | 0.27.7 | indirect |
| npm | @esbuild/linux-riscv64 | 0.27.7 | indirect |
| npm | @esbuild/linux-s390x | 0.27.7 | indirect |
| npm | @esbuild/linux-x64 | 0.27.7 | indirect |
| npm | @esbuild/netbsd-arm64 | 0.27.7 | indirect |
| npm | @esbuild/netbsd-x64 | 0.27.7 | indirect |
| npm | @esbuild/openbsd-arm64 | 0.27.7 | indirect |
| npm | @esbuild/openbsd-x64 | 0.27.7 | indirect |
| npm | @esbuild/openharmony-arm64 | 0.27.7 | indirect |
| npm | @esbuild/sunos-x64 | 0.27.7 | indirect |
| npm | @esbuild/win32-arm64 | 0.27.7 | indirect |
| npm | @esbuild/win32-ia32 | 0.27.7 | indirect |
| npm | @esbuild/win32-x64 | 0.27.7 | indirect |
| npm | @jridgewell/sourcemap-codec | 1.5.5 | indirect |
| npm | @nodelib/fs.scandir | 2.1.5 | indirect |
| npm | @nodelib/fs.stat | 2.0.5 | indirect |
| npm | @nodelib/fs.walk | 1.2.8 | indirect |
| npm | @rollup/rollup-android-arm-eabi | 4.62.0 | indirect |
| npm | @rollup/rollup-android-arm64 | 4.62.0 | indirect |
| npm | @rollup/rollup-darwin-arm64 | 4.62.0 | indirect |
| npm | @rollup/rollup-darwin-x64 | 4.62.0 | indirect |
| npm | @rollup/rollup-freebsd-arm64 | 4.62.0 | indirect |
| npm | @rollup/rollup-freebsd-x64 | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-arm-gnueabihf | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-arm-musleabihf | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-arm64-gnu | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-arm64-musl | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-loong64-gnu | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-loong64-musl | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-ppc64-gnu | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-ppc64-musl | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-riscv64-gnu | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-riscv64-musl | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-s390x-gnu | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-x64-gnu | 4.62.0 | indirect |
| npm | @rollup/rollup-linux-x64-musl | 4.62.0 | indirect |
| npm | @rollup/rollup-openbsd-x64 | 4.62.0 | indirect |
| npm | @rollup/rollup-openharmony-arm64 | 4.62.0 | indirect |
| npm | @rollup/rollup-win32-arm64-msvc | 4.62.0 | indirect |
| npm | @rollup/rollup-win32-ia32-msvc | 4.62.0 | indirect |
| npm | @rollup/rollup-win32-x64-gnu | 4.62.0 | indirect |
| npm | @rollup/rollup-win32-x64-msvc | 4.62.0 | indirect |
| npm | @types/chai | 5.2.3 | indirect |
| npm | @types/deep-eql | 4.0.2 | indirect |
| npm | @types/estree | 1.0.9 | indirect |
| npm | @types/node | 24.13.2 | indirect |
| npm | @vitest/expect | 3.2.6 | indirect |
| npm | @vitest/mocker | 3.2.6 | indirect |
| npm | @vitest/pretty-format | 3.2.6 | indirect |
| npm | @vitest/runner | 3.2.6 | indirect |
| npm | @vitest/snapshot | 3.2.6 | indirect |
| npm | @vitest/spy | 3.2.6 | indirect |
| npm | @vitest/utils | 3.2.6 | indirect |
| npm | assertion-error | 2.0.1 | indirect |
| npm | braces | 3.0.3 | indirect |
| npm | chai | 5.3.3 | indirect |
| npm | check-error | 2.1.3 | indirect |
| npm | debug | 4.4.3 | indirect |
| npm | deep-eql | 5.0.2 | indirect |
| npm | es-module-lexer | 1.7.0 | indirect |
| npm | esbuild | 0.27.7 | indirect |
| npm | estree-walker | 3.0.3 | indirect |
| npm | expect-type | 1.3.0 | indirect |
| npm | fastq | 1.20.1 | indirect |
| npm | fdir | 6.5.0 | indirect |
| npm | fill-range | 7.1.1 | indirect |
| npm | fsevents | 2.3.3 | indirect |
| npm | glob-parent | 5.1.2 | indirect |
| npm | is-extglob | 2.1.1 | indirect |
| npm | is-glob | 4.0.3 | indirect |
| npm | is-number | 7.0.0 | indirect |
| npm | js-tokens | 9.0.1 | indirect |
| npm | loupe | 3.2.1 | indirect |
| npm | magic-string | 0.30.21 | indirect |
| npm | merge2 | 1.4.1 | indirect |
| npm | micromatch | 4.0.8 | indirect |
| npm | ms | 2.1.3 | indirect |
| npm | nanoid | 3.3.12 | indirect |
| npm | pathe | 2.0.3 | indirect |
| npm | pathval | 2.0.1 | indirect |
| npm | picocolors | 1.1.1 | indirect |
| npm | postcss | 8.5.15 | indirect |
| npm | queue-microtask | 1.2.3 | indirect |
| npm | reusify | 1.1.0 | indirect |
| npm | rollup | 4.62.0 | indirect |
| npm | run-parallel | 1.2.0 | indirect |
| npm | siginfo | 2.0.0 | indirect |
| npm | source-map-js | 1.2.1 | indirect |
| npm | stackback | 0.0.2 | indirect |
| npm | std-env | 3.10.0 | indirect |
| npm | strip-literal | 3.1.0 | indirect |
| npm | tinybench | 2.9.0 | indirect |
| npm | tinyexec | 0.3.2 | indirect |
| npm | tinyglobby | 0.2.17 | indirect |
| npm | tinypool | 1.1.1 | indirect |
| npm | tinyrainbow | 2.0.0 | indirect |
| npm | tinyspy | 4.0.4 | indirect |
| npm | to-regex-range | 5.0.1 | indirect |
| npm | typescript | 5.9.3 | indirect |
| npm | undici-types | 7.18.2 | indirect |
| npm | vite | 7.3.5 | indirect |
| npm | vite-node | 3.2.4 | indirect |
| npm | vitest | 3.2.6 | indirect |
| npm | why-is-node-running | 2.3.0 | indirect |
Dependency advisories 0
Installing npm:sniffler@0.5.0 pulls in 20 packages, direct and transitive: 0 carry known advisories, of which 0 are direct dependencies.
No known advisories affect the assessed dependencies.
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 229,
"has_wiki": false,
"homepage": null,
"languages": {
"JavaScript": 51622,
"TypeScript": 420934
},
"pushed_at": "2026-07-23T07:13:15Z",
"created_at": "2026-06-15T16:21:27Z",
"owner_type": "Organization",
"updated_at": "2026-08-01T14:05:44Z",
"description": "Sniffler sniffs out the E2E tests your changes actually wake up.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "master",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript",
"JavaScript"
]
},
"owner": {
"blog": "https://callstack.com",
"name": "Callstack Incubator",
"type": "Organization",
"login": "callstackincubator",
"company": null,
"location": "Worldwide",
"followers": 405,
"avatar_url": "https://avatars.githubusercontent.com/u/40356278?v=4",
"created_at": "2018-06-18T10:38:13Z",
"is_verified": null,
"public_repos": 45,
"account_age_days": 2966
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-07-23T07:14:29Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2026-07-01T10:11:31Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2026-06-30T12:33:39Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-06-26T09:57:34Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-06-22T19:55:21Z"
}
],
"recent_commits": [
{
"oid": "a50efa9632f8a24ea245debae3141275fec1878e",
"body": null,
"is_bot": false,
"headline": "chore: release v0.5.0",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-07-23T07:12:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ef843daf1c43912a687f529cbbae584365b6ad5",
"body": "Closes #29 \n\n## Summary\n\nAdds an opt-in `--uncommitted` mode to `sniffler impact` and `sniffler\nrun`, allowing Sniffler to select tests from staged, unstaged, and\nuntracked non-ignored files without requiring a commit first.\n\nThe new mode can be used by itself or combined with the existing\n`--base`/\n[…]\n\n\nNo analysis benchmark was run because this change is limited to Git\ninput discovery and does not modify scan, parse, or interpret behavior.\n\n---------\n\nCo-authored-by: Szymon Chmal <szymon@chmal.it>",
"is_bot": false,
"headline": "feat: add uncommitted change discovery (#30)",
"author_name": "Chris Lott",
"author_login": "lott-ai",
"committed_at": "2026-07-23T06:52:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c5ab9413ad683c6ad38ffb42199c159a1c66b124",
"body": "## What is this?\n\nThis PR makes `sniffler impact` output easier to scan in a terminal.\nInstead of printing every changed file, affected module, dependency\npath, and warning inline, the text reporter now presents selected E2E\ntests first and follows with a compact summary inspired by\nVitest/Jest-styl\n[…]\nostics information, but without flooding normal CLI output with\nlow-level graph details. Reviewers and CI users can keep using JSON\noutput for full details, while humans get a cleaner terminal report.",
"is_bot": false,
"headline": "Polish impact CLI output (#28)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-07-03T10:56:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "33d3df890201f84ce2c3257c4364d6f2cc4a66a9",
"body": null,
"is_bot": false,
"headline": "chore: release v0.4.0",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-07-01T10:09:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4acc529949285515bd4276e00d97d825530456d9",
"body": "## What is this?\n\nThis PR adds worker-backed source scanning for cache misses. Sniffler\nnow keeps cache lookup, diagnostics, and graph construction on the main\nthread, but can parallelize file reads, import/export parsing, content\nhashing, and metadata collection when the filesystem supports worker\n\n[…]\ngnal for scan-path performance and failures.\n\n## Benchmark Notes\n\nOn Expensify cold runs, `workers: auto` reduced source scan time by\nabout `52%` and total run time by about `33%` versus `workers: 0`.",
"is_bot": false,
"headline": "Add worker-backed source scanning (#26)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-07-01T10:01:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "df76dbf9d8b911896045bd570b99984ccc27b33a",
"body": "## What is this?\n\nThis PR deepens the internal architecture around Sniffler's impact\nanalysis pipeline. The previous implementation kept many policies in a\nfew broad orchestration files, especially impact selection and graph\nbuilding, which made cache behavior, test recommendation rules, graph\nedge \n[…]\nation policy, graph edge semantics, and CLI execution can be\nverified directly. That should reduce accidental regressions while\npreserving the existing behavior expected by CLI users and integrations.",
"is_bot": false,
"headline": "Refactor impact analysis module boundaries (#27)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-07-01T09:53:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e5f2f9e964cf3836446bf0511f685ed98aa9bccf",
"body": "Bump package version to 0.3.0.",
"is_bot": false,
"headline": "chore: release v0.3.0",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-30T12:32:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3db7240caa1b6e19ad89350c568c7211b3054485",
"body": "## What is this?\n\nThis PR adds framework-agnostic synthetic graph edges for file-based\nrouter containment. Projects can now declare containment relationships\nin config so route/layout files discovered through `source.roots` can\nparticipate in forward impact analysis even when the framework composes\n\n[…]\nPR\nlets Sniffler model those relationships without hard-coding framework\nadapters, keeps reverse impact conservative, and makes synthetic hops\nvisible so reviewers can explain why a test was selected.",
"is_bot": false,
"headline": "Support synthetic graph containment edges (#25)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-30T11:56:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1c8d26e198075c404804d7d9f5bf5fcce44cb764",
"body": "## What is this?\n\nThis PR replaces the test-map root object with a plain array of test\nentries and renames each entry's `targets` field to `dependsOn`. It\nkeeps existing repos working by auto-converting the legacy `{ \"tests\":\n[...] }` manifest the first time Sniffler reads it.\n\n## How does it work?\n\n[…]\nrojects keep working because the migration is automatic and\nin-place.\n- Merged branch stayed in the same throughput band after latest\n`origin/master` changes: shared-root 57.8 Hz, deep-branch 95.9 Hz.",
"is_bot": false,
"headline": "feat: migrate test map to array schema (#21)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-30T10:10:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "87d17113f875f4c6bfa718b567aec9051bbf1f0f",
"body": "## What is this?\n\nThis PR adds explicit containment-based test selection for touched app\nroots. Sniffler can now mark a module as a subtree root via\n`tests.invalidateSubtreeWhenTouched`, so changes inside shared code can\nstill fan out through a designated root like `src/App.tsx` and select\ntests bel\n[…]\nected, including\nchanged file, invalidated root, reverse path, and forward containment\npath.\n- Benchmark on `tests/benchmark.bench.ts`: `shared-root` 67.3052 hz,\n`deep-branch` 94.5765 hz.\n\nCloses #22.",
"is_bot": false,
"headline": "Add forward containment traversal for touched roots (#24)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-30T09:59:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f38c31133b6ab4fb7c13d93f9606aba93e8d47c7",
"body": "## What is this?\n\nThis PR extends the release workflow so tag pushes create a GitHub\nRelease after npm publication, with the release description populated\nfrom GitHub-generated release notes instead of a hand-written body.\n\n## How does it work?\n\nThe workflow now checks whether the package version is\n[…]\ne full release path in one workflow, keeps release notes\naligned with GitHub’s own generator, and makes the job recoverable if a\nprior run published the package but failed before creating the release.",
"is_bot": false,
"headline": "chore: create GitHub release with generated notes (#20)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-26T10:21:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e51283251a0788ca454a3fee7f7c0c4544f1ac57",
"body": null,
"is_bot": false,
"headline": "chore: release v0.2.0",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-26T09:55:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7d201856eee2a569eee7c112d7de5829d731e6a4",
"body": null,
"is_bot": false,
"headline": "test: remove version assertion",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-26T09:53:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "755b7c8b49bac62743ab3782de99c1e619a59330",
"body": "## What is this?\n\nThis PR adds two configurable test selection rules for cases the\ndependency graph cannot express cleanly or would make test maps\nrepetitive.\n\n`tests.sharedTargets` lets projects declare source targets that apply to\nevery test entry, such as a global setup module.\n`tests.runAllWhenC\n[…]\n targets across every test-map entry. Lockfile-style changes\nget a cheap short-circuit path, while graph-visible global setup files\nstill benefit from normal dependency analysis and precise reasoning.",
"is_bot": false,
"headline": "feat: add test selection rules (#19)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-26T09:24:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "00019f881ad6494959fba92bd686b69ac4acc13c",
"body": "## What is this?\n\nThis PR adds regression coverage for Sniffler's Git diff mode. The\nprevious tests covered base/head selection through a mocked diff\nprovider, but they did not prove that the default `git diff --name-only\n<base> <head>` path works in a real repository.\n\n## How does it work?\n\nThe new\n[…]\nkflows\ncontinue to work through the actual subprocess-backed Git path. It also\nguards against false positives by confirming that unrelated changed\nfiles are reported without selecting extra E2E tests.",
"is_bot": false,
"headline": "test: cover git diff mode (#14)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-24T08:02:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f4083624fefb681a1285413aeeddba1e53f4532e",
"body": "## What is this?\n\nThis PR adds GitHub Actions automation for Sniffler so every pull\nrequest and `master` push gets the same basic quality gates, and\nreleases can be published to npm from a controlled workflow. Before\nthis, the repo had no checked-in GitHub workflows for test, typecheck,\nlint, or rel\n[…]\nlege GitHub permissions, pins external\nactions by commit, and relies on short-lived OIDC credentials, which\nreduces the risk from cache poisoning, leaked npm tokens, or mutable\nrelease infrastructure.",
"is_bot": false,
"headline": "chore: add GitHub Actions CI and release workflows (#13)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-22T20:07:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "12aac7a157593ab0911d65b426ad6b0876cf32c8",
"body": "## What is this?\n\nThis PR reduces repeated import-resolution work when building Sniffler's\ndependency graph for projects that rely heavily on TSConfig path\naliases. Previously, the same alias imported from many files could\ntrigger the same path matching and filesystem candidate probes over and\nover \n[…]\ns. Large alias-heavy apps spend less\ntime resolving the same imports repeatedly, and the added\ndiagnostics/tests make the cache boundaries easier to reason about when\nfuture resolver behavior changes.",
"is_bot": false,
"headline": "fix: cache tsconfig path resolution (#12)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-22T19:52:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "46a05ba6df2012fddf01967c1bfd2680317d998c",
"body": null,
"is_bot": false,
"headline": "chore: release v0.1.0",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-22T13:29:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "505350c6c6e8fe155b9d4e21781f4739419f48ba",
"body": "## What is this?\n\nThis PR makes Sniffler's test command ignore local benchmark checkouts.\nA cloned benchmark repo under `.benchmark-repos` should not become part\nof Sniffler's own Vitest suite.\n\n## How does it work?\n\nVitest test discovery is narrowed to `tests/**/*.test.ts`, and benchmark\ndiscovery \n[…]\nome stable even after running app-level benchmarks\nlocally. This keeps benchmark fixtures useful without letting their\ndependencies, tsconfig setup, or test files break Sniffler's own\nvalidation flow.",
"is_bot": false,
"headline": "test: isolate benchmark checkouts (#10)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-22T13:28:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7586888796fce8f4fbbb90b9379e97a97cc907da",
"body": "## What is this?\n\nThis PR fixes Sniffler's CLI entrypoint when it is executed through\nnpm's `node_modules/.bin/sniffler` symlink. Installed packages should\nrun the same way as direct `node dist/cli.js` execution.\n\n## How does it work?\n\nThe CLI now resolves the real path of both the current module UR\n[…]\ns normally run Sniffler through package-manager-created\nbin links. Resolving symlinks prevents a silent no-op at startup and\nmakes the packaged CLI behave correctly in modern Node.js ESM\nenvironments.",
"is_bot": false,
"headline": "fix: run CLI through npm bin symlinks (#11)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-22T13:28:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f2324143c96fc89459659b54906c0b44c9ffdaf9",
"body": "## What is this?\n\nThis PR prepares Sniffler's npm package metadata for publishing under\n`callstackincubator/sniffler`. It fills in the package identity fields\nthat npm and GitHub consumers use, while keeping Sniffler positioned as\na CLI-only package.\n\n## How does it work?\n\n`package.json` now include\n[…]\nul?\n\nReviewers and users get clearer package provenance before the first\npublish. Including `src` also makes the published artifact easier to\ninspect and debug without changing how the CLI is invoked.",
"is_bot": false,
"headline": "chore: add package publishing metadata (#9)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-22T13:27:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9e4b243b3c04d87adeb355b5711f518174085ba5",
"body": null,
"is_bot": false,
"headline": "chore: add LICENSE",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-22T11:46:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f60e5b3c4a7accd6667955f292b7ddfb49d6caf",
"body": "## What is this?\n\nThis PR replaces Sniffler's custom collect-all filesystem walker with\n`fast-glob` so source and workspace discovery can use a proven traversal\nengine instead of recursively collecting every file before filtering. It\nalso adds explicit `source.includeNodeModules` configuration so pr\n[…]\n.discover` improved from `141.5 ms` to\n`42.3 ms`, and `impact.workspaces.discover` improved from `228.8 ms` to\n`12.4 ms`, with matching `sourceFiles` and `graphNodes` counts (`7528`)\nbefore and after.",
"is_bot": false,
"headline": "perf: speed up source discovery with fast-glob (#8)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-22T11:44:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cfd5412370fd1957f62da211cba79bc36e350932",
"body": "## What is this?\n\nThis PR adds runtime platform-aware source resolution for React Native\nprojects. Sniffler can now run with `--platform android` or any platform\nstring so extensionless relative imports and TSConfig aliases resolve\nplatform-specific files before native and generic files.\n\n## How doe\n[…]\nithout changing config between platforms. Android, iOS,\nnative, and default runs no longer leak cached resolved edges into each\nother, which keeps impact results correct across platform-specific code.",
"is_bot": false,
"headline": "feat: add Metro-style platform resolution (#7)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-22T09:03:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "49aa4733a870ab1f25c4ac3794f1c340b9af6718",
"body": "## What is this?\n\nThis PR adds warning details to Sniffler diagnostics dumps so issue\nreports include more than timing and metric counters. Diagnostics mode\nnow writes the scanner and resolver warnings that explain where analysis\ncould not statically understand a file or dependency.\n\n## How does it \n[…]\nxt that may explain incomplete\nimpact results. That makes resolution problems easier to reproduce and\navoids asking users for an additional CLI output capture just to\nunderstand what Sniffler skipped.",
"is_bot": false,
"headline": "feat: include warnings in diagnostics dumps (#6)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-19T16:55:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "904a1ca59903bae96330462d44a96232b16a154a",
"body": "## What is this?\n\nThis PR improves Sniffler's cached impact analysis path for large\nrepositories. Warm runs can now reuse previously resolved graph edges\nfor unchanged files, opt into local diagnostics output, and choose how\ncached entries are considered stale through `cache.stale`.\n\n## How does it \n[…]\n show the win comes from `impact.sources.scan` dropping from\nroughly `632-672 ms` to about `89 ms`. The new diagnostics output also\nmakes future performance work easier to measure instead of guessing.",
"is_bot": false,
"headline": "perf: reuse cached resolved edges (#5)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-19T14:33:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "119869c3fa590635a14855322fe2b45172a6c1bd",
"body": "## What is this?\n\nThis PR fixes several resolver edge cases that could produce graph edges\npointing at the wrong path or skip the intended source file in common\nTypeScript and JavaScript project layouts. It also adds regression\ncoverage for resolver orchestration, package export conditions,\nworkspac\n[…]\n point at scanned source files more\nconsistently, package exports avoid directory-only false positives, and\noverlapping TSConfig aliases behave predictably when broad and specific\npatterns both match.",
"is_bot": false,
"headline": "fix: tighten resolver edge cases (#4)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-19T07:06:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3d05f9d34c6e2f63c9ec88aed9e134a09b905dd9",
"body": "Document Sniffler configuration defaults, properties, and setup flow. Add a short getting started config example to the README.",
"is_bot": false,
"headline": "docs: add config docs",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-18T17:23:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f2e87eb0949ca0cc889298e0bc47c7ec86bc090",
"body": null,
"is_bot": false,
"headline": "docs: add logo",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-18T16:05:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b0ae63a1ef475216ca846e3dec0ced0edc3bee00",
"body": null,
"is_bot": false,
"headline": "docs: improve README.md",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-18T16:02:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a07a508d3368014ae63003c3cda704768b907fee",
"body": null,
"is_bot": false,
"headline": "chore: remove unneeded docs",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-18T15:42:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b35d718b119fdd4a5081d25d33a90a30400aa367",
"body": "## What is this?\n\nThis PR improves Sniffler impact-selection performance and adds a\nreal-app benchmark harness against Expensify/App. The performance work\nkeeps scanner and graph behavior stable while reducing hot-path overhead\nand enabling scan reuse on repeated impact runs.\n\n## How does it work?\n\n\n[…]\n673.8 ms` | `2895.3 ms` |\n| `routes` | `3604.3 ms` | `2921.5 ms` |\n\nValidation run locally:\n\n```sh\npnpm test\npnpm lint\nnode scripts/benchmark-expensify-app.mjs --iterations 1 --warmup 0 --no-build\n```",
"is_bot": false,
"headline": "perf: improve impact selection throughput (#2)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-18T14:44:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "56462ff94549daee67bed519be717d53a866cb3c",
"body": "## What is this?\n\nThis PR moves Sniffler's CLI from hand-rolled parsing to `cac`. It\nchanges the CLI contract to use positional changed files or\n`--base`/`--head`, removes `--changed`, and adds explicit `--version`\nsupport.\n\n## How does it work?\n\nThis PR builds a fresh `cac` instance for each `runCl\n[…]\nHelp and version output are handled in one command parser instead of\ncustom branching.\n- The new contract matches the plan: positional files, clearer\nvalidation, and no `--changed` compatibility shim.",
"is_bot": false,
"headline": "refactor: move sniffler CLI to cac (#3)",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-18T14:30:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3b53eb1f2a7a726822105ad33c70a37c8160c567",
"body": null,
"is_bot": false,
"headline": "Add fixture-backed integration coverage",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T16:06:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "199828f78e3ccc837eac93b3c43bee2ee60a0aa5",
"body": null,
"is_bot": false,
"headline": "Add runnable basic chain fixture",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T15:52:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3f471afd50070acded42d666187a283cb766fcd9",
"body": null,
"is_bot": false,
"headline": "Add basic chain fixture",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T15:50:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d2b13f9868f666664f2b1ae890a23d129efd49c6",
"body": null,
"is_bot": false,
"headline": "Implement impact CLI command",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T15:39:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ef39e0d28d288ecc51ed7fa63d06f34327761f98",
"body": null,
"is_bot": false,
"headline": "Implement cache loading and atomic save",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T15:26:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6833293f788ce7c59b2a74a34369046177020bfb",
"body": null,
"is_bot": false,
"headline": "Implement package exports resolution",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T15:18:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fdf41b7c72f1c090df6775e6ce237771e9f663fd",
"body": null,
"is_bot": false,
"headline": "Add workspace and tsconfig resolvers",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T15:04:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c5661fc20143f1b8cc120552957f5c3b3b4a2fd0",
"body": null,
"is_bot": false,
"headline": "feat: add workspace discovery",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T14:59:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c10728746717904c7d394344b3b8330479b4f2d1",
"body": null,
"is_bot": false,
"headline": "Implement manifest test matching",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T14:51:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f2e3f0b6afe81a9034caf4aed56288601f42260",
"body": null,
"is_bot": false,
"headline": "Implement graph traversal slice",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T12:19:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "edd64ddbcb53dd5ec557b3b8bcb521e33f8e985a",
"body": null,
"is_bot": false,
"headline": "Implement lightweight import scanner",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T12:10:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c33471eb4a7e632492b04c66239fb269a7bbf6ea",
"body": null,
"is_bot": false,
"headline": "feat: add config and test map loaders",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T12:02:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c0ec02988035bc87d16743dfe92209891c9f0e13",
"body": null,
"is_bot": false,
"headline": "Implement filesystem adapters and JSON errors",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T09:11:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5b1680beeae23a6e3d1a00d1d05303e45dcdd0b5",
"body": null,
"is_bot": false,
"headline": "Scaffold sniffler package",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T08:55:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f5c64e11fff267c7ad50b4f139d86a6491780d9",
"body": null,
"is_bot": false,
"headline": "Add implementation plan for sniffler",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T08:39:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "761b3544f36acba0faa20781321e95d7574ef341",
"body": null,
"is_bot": false,
"headline": "docs: add e2e impact selector spec",
"author_name": "Szymon Chmal",
"author_login": "V3RON",
"committed_at": "2026-06-15T08:28:01Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 5,
"commits_last_year": 49,
"latest_release_at": "2026-07-23T07:14:29Z",
"latest_release_tag": "v0.5.0",
"releases_from_tags": false,
"days_since_last_push": 9,
"active_weeks_last_year": 4,
"days_since_latest_release": 9,
"mean_days_between_releases": 7.6
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 50,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "sniffler",
"exists": true,
"license": "MIT",
"keywords": [
"cli",
"e2e",
"impact-analysis",
"javascript",
"monorepo",
"react-native",
"sniffler",
"typescript",
"vitest"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/sniffler",
"is_deprecated": false,
"latest_version": "0.5.0",
"repository_url": "https://github.com/callstackincubator/sniffler",
"versions_count": 5,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 3343,
"first_published_at": "2026-06-22T13:31:09.297000Z",
"latest_published_at": "2026-07-23T07:14:26.026000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 9
}
]
},
"popularity": {
"forks": 1,
"stars": 29,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-07-13",
"count": 1
}
],
"complete": true,
"collected": 1,
"total_forks": 1
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"tests/fixtures/tsconfig-paths/tsconfig.json",
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 32290,
"source_files_sampled": 117,
"oversized_source_files": 0,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 162
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 20,
"malicious_count": 0,
"assessed_package": "npm:sniffler@0.5.0",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "cac",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^7.0.0"
},
{
"name": "fast-glob",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^3.3.3"
},
{
"name": "picomatch",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^4.0.4"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "cac",
"direct": true,
"version": "6.7.14",
"ecosystem": "npm"
},
{
"name": "cac",
"direct": true,
"version": "7.0.0",
"ecosystem": "npm"
},
{
"name": "fast-glob",
"direct": true,
"version": "3.3.3",
"ecosystem": "npm"
},
{
"name": "picomatch",
"direct": true,
"version": "2.3.2",
"ecosystem": "npm"
},
{
"name": "picomatch",
"direct": true,
"version": "4.0.4",
"ecosystem": "npm"
},
{
"name": "@esbuild/aix-ppc64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/android-arm",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/android-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/android-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/darwin-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/darwin-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/freebsd-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/freebsd-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-arm",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-ia32",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-loong64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-mips64el",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-ppc64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-riscv64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-s390x",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/netbsd-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/netbsd-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/openbsd-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/openbsd-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/openharmony-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/sunos-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/win32-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/win32-ia32",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/win32-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@jridgewell/sourcemap-codec",
"direct": false,
"version": "1.5.5",
"ecosystem": "npm"
},
{
"name": "@nodelib/fs.scandir",
"direct": false,
"version": "2.1.5",
"ecosystem": "npm"
},
{
"name": "@nodelib/fs.stat",
"direct": false,
"version": "2.0.5",
"ecosystem": "npm"
},
{
"name": "@nodelib/fs.walk",
"direct": false,
"version": "1.2.8",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-android-arm-eabi",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-android-arm64",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-darwin-arm64",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-darwin-x64",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-freebsd-arm64",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-freebsd-x64",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-arm-gnueabihf",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-arm-musleabihf",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-arm64-gnu",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-arm64-musl",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-loong64-gnu",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-loong64-musl",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-ppc64-gnu",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-ppc64-musl",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-riscv64-gnu",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-riscv64-musl",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-s390x-gnu",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-x64-gnu",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-x64-musl",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-openbsd-x64",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-openharmony-arm64",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-win32-arm64-msvc",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-win32-ia32-msvc",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-win32-x64-gnu",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-win32-x64-msvc",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "@types/chai",
"direct": false,
"version": "5.2.3",
"ecosystem": "npm"
},
{
"name": "@types/deep-eql",
"direct": false,
"version": "4.0.2",
"ecosystem": "npm"
},
{
"name": "@types/estree",
"direct": false,
"version": "1.0.9",
"ecosystem": "npm"
},
{
"name": "@types/node",
"direct": false,
"version": "24.13.2",
"ecosystem": "npm"
},
{
"name": "@vitest/expect",
"direct": false,
"version": "3.2.6",
"ecosystem": "npm"
},
{
"name": "@vitest/mocker",
"direct": false,
"version": "3.2.6",
"ecosystem": "npm"
},
{
"name": "@vitest/pretty-format",
"direct": false,
"version": "3.2.6",
"ecosystem": "npm"
},
{
"name": "@vitest/runner",
"direct": false,
"version": "3.2.6",
"ecosystem": "npm"
},
{
"name": "@vitest/snapshot",
"direct": false,
"version": "3.2.6",
"ecosystem": "npm"
},
{
"name": "@vitest/spy",
"direct": false,
"version": "3.2.6",
"ecosystem": "npm"
},
{
"name": "@vitest/utils",
"direct": false,
"version": "3.2.6",
"ecosystem": "npm"
},
{
"name": "assertion-error",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "braces",
"direct": false,
"version": "3.0.3",
"ecosystem": "npm"
},
{
"name": "chai",
"direct": false,
"version": "5.3.3",
"ecosystem": "npm"
},
{
"name": "check-error",
"direct": false,
"version": "2.1.3",
"ecosystem": "npm"
},
{
"name": "debug",
"direct": false,
"version": "4.4.3",
"ecosystem": "npm"
},
{
"name": "deep-eql",
"direct": false,
"version": "5.0.2",
"ecosystem": "npm"
},
{
"name": "es-module-lexer",
"direct": false,
"version": "1.7.0",
"ecosystem": "npm"
},
{
"name": "esbuild",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "estree-walker",
"direct": false,
"version": "3.0.3",
"ecosystem": "npm"
},
{
"name": "expect-type",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "fastq",
"direct": false,
"version": "1.20.1",
"ecosystem": "npm"
},
{
"name": "fdir",
"direct": false,
"version": "6.5.0",
"ecosystem": "npm"
},
{
"name": "fill-range",
"direct": false,
"version": "7.1.1",
"ecosystem": "npm"
},
{
"name": "fsevents",
"direct": false,
"version": "2.3.3",
"ecosystem": "npm"
},
{
"name": "glob-parent",
"direct": false,
"version": "5.1.2",
"ecosystem": "npm"
},
{
"name": "is-extglob",
"direct": false,
"version": "2.1.1",
"ecosystem": "npm"
},
{
"name": "is-glob",
"direct": false,
"version": "4.0.3",
"ecosystem": "npm"
},
{
"name": "is-number",
"direct": false,
"version": "7.0.0",
"ecosystem": "npm"
},
{
"name": "js-tokens",
"direct": false,
"version": "9.0.1",
"ecosystem": "npm"
},
{
"name": "loupe",
"direct": false,
"version": "3.2.1",
"ecosystem": "npm"
},
{
"name": "magic-string",
"direct": false,
"version": "0.30.21",
"ecosystem": "npm"
},
{
"name": "merge2",
"direct": false,
"version": "1.4.1",
"ecosystem": "npm"
},
{
"name": "micromatch",
"direct": false,
"version": "4.0.8",
"ecosystem": "npm"
},
{
"name": "ms",
"direct": false,
"version": "2.1.3",
"ecosystem": "npm"
},
{
"name": "nanoid",
"direct": false,
"version": "3.3.12",
"ecosystem": "npm"
},
{
"name": "pathe",
"direct": false,
"version": "2.0.3",
"ecosystem": "npm"
},
{
"name": "pathval",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "picocolors",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "postcss",
"direct": false,
"version": "8.5.15",
"ecosystem": "npm"
},
{
"name": "queue-microtask",
"direct": false,
"version": "1.2.3",
"ecosystem": "npm"
},
{
"name": "reusify",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "rollup",
"direct": false,
"version": "4.62.0",
"ecosystem": "npm"
},
{
"name": "run-parallel",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "siginfo",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "source-map-js",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "stackback",
"direct": false,
"version": "0.0.2",
"ecosystem": "npm"
},
{
"name": "std-env",
"direct": false,
"version": "3.10.0",
"ecosystem": "npm"
},
{
"name": "strip-literal",
"direct": false,
"version": "3.1.0",
"ecosystem": "npm"
},
{
"name": "tinybench",
"direct": false,
"version": "2.9.0",
"ecosystem": "npm"
},
{
"name": "tinyexec",
"direct": false,
"version": "0.3.2",
"ecosystem": "npm"
},
{
"name": "tinyglobby",
"direct": false,
"version": "0.2.17",
"ecosystem": "npm"
},
{
"name": "tinypool",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "tinyrainbow",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "tinyspy",
"direct": false,
"version": "4.0.4",
"ecosystem": "npm"
},
{
"name": "to-regex-range",
"direct": false,
"version": "5.0.1",
"ecosystem": "npm"
},
{
"name": "typescript",
"direct": false,
"version": "5.9.3",
"ecosystem": "npm"
},
{
"name": "undici-types",
"direct": false,
"version": "7.18.2",
"ecosystem": "npm"
},
{
"name": "vite",
"direct": false,
"version": "7.3.5",
"ecosystem": "npm"
},
{
"name": "vite-node",
"direct": false,
"version": "3.2.4",
"ecosystem": "npm"
},
{
"name": "vitest",
"direct": false,
"version": "3.2.6",
"ecosystem": "npm"
},
{
"name": "why-is-node-running",
"direct": false,
"version": "2.3.0",
"ecosystem": "npm"
}
],
"collected": true,
"truncated": false,
"total_count": 122,
"direct_count": 5,
"indirect_count": 117
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 22,
"open_issues": 1,
"closed_ratio": 0.857,
"closed_issues": 6,
"closed_unmerged_prs": 1
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "V3RON",
"commits": 48,
"avatar_url": "https://avatars.githubusercontent.com/u/8137511?v=4"
},
{
"type": "User",
"login": "lott-ai",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/7423098?v=4"
}
],
"contributors_sampled": 2,
"top_contributor_share": 0.98
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"release.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"pnpm-lock.yaml"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 5,
"reason": "11 out of 20 merged PRs checked by a CI test -- score normalized to 5",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 1/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 10,
"reason": "all dependencies are pinned",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 4,
"reason": "SAST tool is not run on all commits -- score normalized to 4",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 10,
"reason": "GitHub workflow tokens follow principle of least privilege",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 8,
"reason": "2 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "a50efa9632f8a24ea245debae3141275fec1878e",
"ran_at": "2026-08-01T21:09:04Z",
"aggregate_score": 4.9,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-28T10:44:05Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-23T06:52:50Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 15,
"created_at": "2026-06-25T10:19:13Z",
"last_comment_at": "2026-06-25T10:23:45Z",
"last_comment_author": "V3RON"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/callstackincubator/sniffler",
"host": "github.com",
"name": "sniffler",
"owner": "callstackincubator"
},
"metrics": {
"overall": {
"key": "overall",
"band": "good",
"name": "Overall health",
"note": "The weighted overall 60 is calibrated to 65 on the published index scale (record calibration 2026-08-02).",
"notes": [
{
"code": "overall_calibration",
"params": {
"raw": 60,
"calibrated": 65,
"calibration": "2026-08-02"
}
}
],
"value": 65,
"inputs": {
"security": 59,
"vitality": 68,
"community": 49,
"governance": 61,
"calibration": "2026-08-02",
"engineering": 61,
"ai_readiness": 63,
"weighted_overall_raw": 60
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 68,
"weight": 0.21,
"metrics": [
{
"key": "development_activity",
"band": "weak",
"name": "Development activity",
"note": null,
"notes": [],
"value": 47,
"inputs": {
"commits_last_year": 49,
"human_commit_share": 1,
"days_since_last_push": 9,
"active_weeks_last_year": 4
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 9 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 9
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "4/52 weeks with commits",
"points": 2.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 4
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "49 commits in the last year",
"points": 15.3,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 49
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "exceptional",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 5,
"latest_release_tag": "v0.5.0",
"releases_from_tags": false,
"days_since_latest_release": 9,
"mean_days_between_releases": 7.6
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "5 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 5
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 9 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 9
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~7.6 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 7.6
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "exceptional",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "weak",
"name": "Community & Adoption",
"value": 49,
"weight": 0.17,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 24,
"inputs": {
"forks": 1,
"stars": 29,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "29 stars",
"points": 23.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 29
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "1 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 1
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_readme": true,
"has_license": true,
"readme_badges": null,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"readme_badge_services": [],
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 59,
"inputs": {
"packages": [
"sniffler"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 3343
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "3,343 downloads/month across npm",
"points": 47,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 3343,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 61,
"weight": 0.23,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 15,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 2,
"top_contributor_share": 0.98
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 98% of commits",
"points": 0.5,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 98
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "2 contributors",
"points": 2.7,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 2
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"newcomer_pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 74,
"inputs": {
"merged_prs": 22,
"open_issues": 1,
"closed_issues": 6,
"prs_merged_7d": null,
"prs_decided_7d": null,
"prs_merged_30d": null,
"prs_decided_30d": null,
"issue_closed_ratio": 0.857,
"closed_unmerged_prs": 1,
"first_time_authors_30d": null,
"first_time_prs_merged_30d": null,
"first_time_prs_decided_30d": null
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "86% of issues closed",
"points": 36,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 86
}
}
],
"max_points": 42
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "22/23 decided PRs merged",
"points": 28.7,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 22,
"decided": 23
}
}
],
"max_points": 30
},
{
"key": "newcomer_pr_acceptance",
"name": "Newcomer PR acceptance",
"detail": "no first-time contributor's PR decided in 30d",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_newcomer_prs",
"params": {
"days": 30
}
}
],
"max_points": 13
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 1/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 73,
"inputs": {
"followers": 405,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "callstackincubator",
"public_repos": 45,
"account_age_days": 2966
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "405 followers of callstackincubator",
"points": 18.8,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 405,
"login": "callstackincubator"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "45 public repos, account ~8 yr old",
"points": 24.1,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 45
}
},
{
"code": "account_age_years",
"params": {
"years": 8
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "exceptional",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"sniffler"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 9
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 9 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 9
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "5 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 5
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 61,
"weight": 0.19,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 58,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "11 out of 20 merged PRs checked by a CI test -- score normalized to 5",
"points": 10,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"topics": [],
"has_wiki": false,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 59,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "weak",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 49,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 4.9
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "11 out of 20 merged PRs checked by a CI test -- score normalized to 5",
"points": 1.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 1/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 4",
"points": 2,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "GitHub workflow tokens follow principle of least privilege",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "2 existing vulnerabilities detected",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "exceptional",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:sniffler@0.5.0 runtime dependency closure — what installing the published package pulls in — 20 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "npm:sniffler@0.5.0",
"assessed": 20
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 20,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "exceptional",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 20,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "exceptional",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"commit_weight_rule": {
"min_commits": 50,
"min_commit_share": 0.1
},
"review_only_matches": 0,
"below_threshold_exposures": [],
"assessed_self_published_locations": 5
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 63,
"weight": 0.04,
"metrics": [
{
"key": "ai_agent_context",
"band": "moderate",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 57,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.735,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 162
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "AGENTS.md (stub)",
"points": 18,
"status": "partial",
"details": [
{
"code": "file_list",
"params": {
"files": "AGENTS.md"
}
},
{
"code": "agent_instructions_stub",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "36 of 49 human commits state their intent (structured subject or explanatory body)",
"points": 39.2,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 36,
"sampled": 49
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"pnpm-lock.yaml"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"tests/fixtures/tsconfig-paths/tsconfig.json",
"tsconfig.json"
],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "tests/fixtures/tsconfig-paths/tsconfig.json, tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "tests/fixtures/tsconfig-paths/tsconfig.json, tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 49",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 49
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "exceptional",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 32290,
"source_files_sampled": 117,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/117 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 117,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
}
],
"classification": {
"top": [
"library",
"application"
],
"labels": [
"cli",
"library"
],
"scores": {
"cli": 6,
"library": 6
},
"primary": "cli",
"evidence": [
{
"tier": "distribution",
"label": "library",
"source": "registry:npm",
"weight": 6
},
{
"tier": "dependencies",
"label": "cli",
"source": "dep:cac",
"weight": 4
},
{
"tier": "tags",
"label": "cli",
"source": "tag:cli",
"weight": 2
}
],
"artifacts": [],
"confidence": "medium",
"host_extension": false,
"runs_as_process": true,
"consumed_by_code": true
},
"metrics_version": "2.5.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-08-01T21:09:17.355275Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/c/callstackincubator/sniffler.svg",
"full_name": "callstackincubator/sniffler",
"license_state": "standard",
"license_spdx": "MIT"
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v2.5.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — npm.