jeremyevans/rodauth holds a health index of 70 out of 100, placing it in the Good band. It scores highest on Vitality (76/100) and lowest on AI Readiness (29/100). It was last updated today. A single contributor accounts for most of its recent work.
70
overall / 100
Good
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
70
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Type-checkable code — Ruby without a type-check config
54.5/55
Manageable file sizes — 1/112 source files over 60KB
Inputs used
primary_language
Ruby
largest_source_bytes
106,951
source_files_sampled
112
oversized_source_files
1
Key facts
1,918GitHub stars
40contributors
42commits, last 12 months
0days since last push
75releases
1bus factor
0open issues
—package ecosystems
Data collection warnings
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
No resolved dependencies carried a version and a supported ecosystem
More detail
Star and fork history 0 ★ / 111 ⇿
0Stars
111Forks
73Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 2Minor 68Patch 3
Each point covers 10 days.
OpenSSF Scorecard 6.1 / 10
6.1aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-24 20:29 UTC
Full resolved dependency set from the GitHub dependency graph: 0 direct and 15 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
Registry
Package
Version
Relation
RubyGems
argon2
—
indirect
RubyGems
bcrypt
—
indirect
RubyGems
capybara
—
indirect
RubyGems
jwt
—
indirect
RubyGems
mail
—
indirect
RubyGems
minitest
—
indirect
RubyGems
minitest-global_expectations
—
indirect
RubyGems
minitest-hooks
—
indirect
RubyGems
rack_csrf
—
indirect
RubyGems
roda
—
indirect
RubyGems
rotp
—
indirect
RubyGems
rqrcode
—
indirect
RubyGems
sequel
—
indirect
RubyGems
tilt
—
indirect
RubyGems
webauthn
—
indirect
Dependency advisories not assessed
Advisory matching could not run for this report: No resolved dependencies carried a version and a supported ecosystem
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 5468,
"has_wiki": false,
"homepage": "http://rodauth.jeremyevans.net",
"languages": {
"CSS": 719,
"HTML": 28951,
"Ruby": 902141,
"TSQL": 415,
"JavaScript": 5075
},
"pushed_at": "2026-07-24T20:25:07Z",
"created_at": "2015-08-12T15:11:41Z",
"owner_type": "User",
"updated_at": "2026-07-24T20:15:07Z",
"description": "Ruby's Most Advanced Authentication Framework",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "master",
"license_spdx_raw": "MIT",
"primary_language": "Ruby",
"significant_languages": [
"Ruby"
]
},
"owner": {
"blog": "http://code.jeremyevans.net",
"name": "Jeremy Evans",
"type": "User",
"login": "jeremyevans",
"company": "Ubicloud, Inc.",
"location": "Sacramento, California, USA",
"followers": 1742,
"avatar_url": "https://avatars.githubusercontent.com/u/3846?v=4",
"created_at": "2008-03-26T00:07:41Z",
"is_verified": null,
"public_repos": 239,
"account_age_days": 6694
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "2.45.0",
"kind": "minor",
"published_at": "2026-07-24T20:12:13Z"
},
{
"tag": "2.44.0",
"kind": "minor",
"published_at": "2026-06-08T16:04:40Z"
},
{
"tag": "2.43.0",
"kind": "minor",
"published_at": "2026-03-20T14:32:02Z"
},
{
"tag": "2.42.0",
"kind": "minor",
"published_at": "2025-12-18T20:18:08Z"
},
{
"tag": "2.41.0",
"kind": "minor",
"published_at": "2025-10-08T15:10:21Z"
},
{
"tag": "2.40.0",
"kind": "minor",
"published_at": "2025-08-22T18:24:12Z"
},
{
"tag": "2.39.0",
"kind": "minor",
"published_at": "2025-05-22T18:52:06Z"
},
{
"tag": "2.38.0",
"kind": "minor",
"published_at": "2025-01-15T18:52:28Z"
},
{
"tag": "2.37.0",
"kind": "minor",
"published_at": "2024-11-19T17:20:09Z"
},
{
"tag": "2.36.0",
"kind": "minor",
"published_at": "2024-07-23T15:11:25Z"
},
{
"tag": "2.35.0",
"kind": "minor",
"published_at": "2024-05-28T18:21:08Z"
},
{
"tag": "2.34.0",
"kind": "minor",
"published_at": "2024-03-22T15:42:50Z"
},
{
"tag": "2.33.0",
"kind": "minor",
"published_at": "2023-12-21T17:00:16Z"
},
{
"tag": "2.32.0",
"kind": "minor",
"published_at": "2023-10-23T15:50:21Z"
},
{
"tag": "2.31.0",
"kind": "minor",
"published_at": "2023-08-22T16:13:38Z"
},
{
"tag": "2.30.0",
"kind": "minor",
"published_at": "2023-05-22T15:23:13Z"
},
{
"tag": "2.29.0",
"kind": "minor",
"published_at": "2023-03-22T14:34:46Z"
},
{
"tag": "2.28.0",
"kind": "minor",
"published_at": "2023-02-22T16:36:55Z"
},
{
"tag": "2.27.0",
"kind": "minor",
"published_at": "2023-01-24T16:37:09Z"
},
{
"tag": "2.26.1",
"kind": "patch",
"published_at": "2022-11-08T16:47:06Z"
},
{
"tag": "2.26.0",
"kind": "minor",
"published_at": "2022-10-21T17:12:00Z"
},
{
"tag": "2.25.0",
"kind": "minor",
"published_at": "2022-06-22T14:40:32Z"
},
{
"tag": "2.24.0",
"kind": "minor",
"published_at": "2022-05-24T14:22:35Z"
},
{
"tag": "2.23.0",
"kind": "minor",
"published_at": "2022-04-22T15:41:27Z"
},
{
"tag": "2.22.0",
"kind": "minor",
"published_at": "2022-03-22T15:18:37Z"
},
{
"tag": "2.21.0",
"kind": "minor",
"published_at": "2022-02-22T20:29:10Z"
},
{
"tag": "2.20.0",
"kind": "minor",
"published_at": "2022-01-24T16:47:52Z"
},
{
"tag": "2.19.0",
"kind": "minor",
"published_at": "2021-12-22T17:41:16Z"
},
{
"tag": "2.18.0",
"kind": "minor",
"published_at": "2021-11-23T16:26:56Z"
},
{
"tag": "2.17.0",
"kind": "minor",
"published_at": "2021-09-24T16:50:44Z"
},
{
"tag": "2.16.0",
"kind": "minor",
"published_at": "2021-08-23T15:24:22Z"
},
{
"tag": "2.15.0",
"kind": "minor",
"published_at": "2021-07-27T16:11:01Z"
},
{
"tag": "2.14.0",
"kind": "minor",
"published_at": "2021-06-22T14:43:32Z"
},
{
"tag": "2.13.0",
"kind": "minor",
"published_at": "2021-05-21T19:44:33Z"
},
{
"tag": "2.12.0",
"kind": "minor",
"published_at": "2021-04-22T14:54:25Z"
},
{
"tag": "2.11.0",
"kind": "minor",
"published_at": "2021-03-22T18:58:16Z"
},
{
"tag": "2.10.0",
"kind": "minor",
"published_at": "2021-02-22T16:46:21Z"
},
{
"tag": "2.9.0",
"kind": "minor",
"published_at": "2021-01-23T00:07:08Z"
},
{
"tag": "2.8.0",
"kind": "minor",
"published_at": "2021-01-06T20:27:56Z"
},
{
"tag": "2.7.0",
"kind": "minor",
"published_at": "2020-12-22T17:52:36Z"
},
{
"tag": "2.6.0",
"kind": "minor",
"published_at": "2020-11-20T17:00:00Z"
},
{
"tag": "2.5.0",
"kind": "minor",
"published_at": "2020-10-22T15:34:33Z"
},
{
"tag": "2.4.0",
"kind": "minor",
"published_at": "2020-09-21T14:54:12Z"
},
{
"tag": "2.3.0",
"kind": "minor",
"published_at": "2020-08-21T15:21:39Z"
},
{
"tag": "2.2.0",
"kind": "minor",
"published_at": "2020-07-20T15:17:45Z"
},
{
"tag": "2.1.0",
"kind": "minor",
"published_at": "2020-06-09T14:51:43Z"
},
{
"tag": "2.0.0",
"kind": "major",
"published_at": "2020-05-06T15:56:09Z"
},
{
"tag": "1.23.0",
"kind": "minor",
"published_at": "2020-03-06T16:14:17Z"
},
{
"tag": "1.22.0",
"kind": "minor",
"published_at": "2019-10-29T18:29:02Z"
},
{
"tag": "1.21.0",
"kind": "minor",
"published_at": "2019-07-24T17:10:27Z"
},
{
"tag": "1.20.0",
"kind": "minor",
"published_at": "2019-06-07T19:08:46Z"
},
{
"tag": "1.19.1",
"kind": "patch",
"published_at": "2018-11-16T20:20:29Z"
},
{
"tag": "1.19.0",
"kind": "minor",
"published_at": "2018-11-16T18:38:09Z"
},
{
"tag": "1.18.0",
"kind": "minor",
"published_at": "2018-07-18T15:11:22Z"
},
{
"tag": "1.17.0",
"kind": "minor",
"published_at": "2018-06-11T19:46:44Z"
},
{
"tag": "1.16.0",
"kind": "minor",
"published_at": "2018-03-09T19:36:48Z"
},
{
"tag": "1.15.0",
"kind": "minor",
"published_at": "2018-01-29T23:18:28Z"
},
{
"tag": "1.14.0",
"kind": "minor",
"published_at": "2017-12-19T20:40:02Z"
},
{
"tag": "1.13.0",
"kind": "minor",
"published_at": "2017-11-21T18:40:13Z"
},
{
"tag": "1.12.0",
"kind": "minor",
"published_at": "2017-10-03T16:52:47Z"
},
{
"tag": "1.11.0",
"kind": "minor",
"published_at": "2017-04-24T16:18:26Z"
},
{
"tag": "1.10.0",
"kind": "minor",
"published_at": "2017-03-23T19:00:47Z"
},
{
"tag": "1.9.0",
"kind": "minor",
"published_at": "2017-02-22T20:05:56Z"
},
{
"tag": "1.8.0",
"kind": "minor",
"published_at": "2017-01-06T17:51:33Z"
},
{
"tag": "1.7.0",
"kind": "minor",
"published_at": "2016-11-22T16:07:16Z"
},
{
"tag": "1.6.0",
"kind": "minor",
"published_at": "2016-10-24T17:04:10Z"
},
{
"tag": "1.5.0",
"kind": "minor",
"published_at": "2016-09-22T20:35:31Z"
},
{
"tag": "1.4.0",
"kind": "minor",
"published_at": "2016-08-18T17:46:20Z"
},
{
"tag": "1.3.0",
"kind": "minor",
"published_at": "2016-07-19T18:57:00Z"
},
{
"tag": "1.2.0",
"kind": "minor",
"published_at": "2016-06-15T15:39:35Z"
},
{
"tag": "1.1.0",
"kind": "minor",
"published_at": "2016-05-13T15:29:18Z"
},
{
"tag": "1.0.0",
"kind": "major",
"published_at": "2016-04-15T14:46:36Z"
},
{
"tag": "0.10.0",
"kind": "minor",
"published_at": "2016-02-16T21:43:18Z"
},
{
"tag": "0.9.1",
"kind": "patch",
"published_at": "2015-08-13T15:47:54Z"
},
{
"tag": "0.9.0",
"kind": "minor",
"published_at": "2015-08-12T15:09:00Z"
}
],
"recent_commits": [
{
"oid": "758b7a565514178a8bbf6740f9694f4c7aec1e7f",
"body": null,
"is_bot": false,
"headline": "Bump version to 2.45.0",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-07-24T20:12:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8471e32e232294313d8545dcfa6b7c0ce21266c7",
"body": "Previously, it operating in the Roda scope, not in Rodauth scope.\nWhile it's a good idea in Roda scope (at least when the Roda\nshape_friendly plugin is used), that change should be made in Roda.\nWe should only make the change for Rodauth scope, so move this to\nBase. Additionally, add a spec for it (the spec is actually what\ncaught this issue), and move the nocov markers to only contain the\nif.",
"is_bot": false,
"headline": "Fix instance_variables_to_inspect place",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-07-12T16:15:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4471bbcc90977ace68e50ccd33cf38511c2ce24a",
"body": null,
"is_bot": false,
"headline": "Exclude nil instance variables from `#inspect` output on Ruby 4+",
"author_name": "Janko Marohnić",
"author_login": "janko",
"committed_at": "2026-07-12T11:09:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "643ace6a8abfe82c25f4caa459ba3141cb025014",
"body": "This sets the SCOPE_INSTANCE_VARIABLES plugin constant so that\nthe Roda scope instance variables that rodauth uses are set to\nnil on initialization.",
"is_bot": false,
"headline": "Work with Roda shape_friendly plugin",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-07-10T21:37:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5d5255fd7135a210873d2dc0027a0e67657174a1",
"body": "This helps avoid default hash allocations. The default hashes\nshouldn't be modified, and this helps detect cases where they are.\n\nAdditionally, places that use {}.freeze switch to using OPTS.\nOn Ruby 3.4+, these places don't allocate, but this helps avoid\nallocations on earlier versions.",
"is_bot": false,
"headline": "Add Rodauth::OPTS empty frozen hash",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-07-10T21:37:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1b1fe6240e618adfdade786c22bbd7375ffee853",
"body": "This hasn't been needed since Ruby 1.8 support was dropped.",
"is_bot": false,
"headline": "Remove unnecessary to_sym calls",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-07-10T21:37:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d000a6e1c87c38b9aebf85ac0f5a2fed5fc2ab9",
"body": "…tions\n\nThe expected use case is for setting transaction isolation levels,\nbut it can be used for other things.",
"is_bot": false,
"headline": "Add transaction_opts configuration method for defining transaction op…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-07-10T21:37:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2732c44d1095f47ba552666a38adf87bd8c4732e",
"body": "… does not implement\n\nIn this case, it is likely that the feature configuration methods do\nnot operate as expected. If a feature really needs a configuration\nmethod to define a method that it does not itself define, they can\nuse the new allowed_undefined_configuration_methods accessor. The\njson feature uses it to allow configuration of the only_json? method,\nwhich is defined in the base feature.\n\nThese warnings found all of the issues solved in the recent commits.",
"is_bot": false,
"headline": "Warn if feature configuration methods define methods that the feature…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-06-10T23:01:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6a4caa2fb285f58b2618b172cf46f0ae9afe96ee",
"body": "…ature work as expected\n\nPreviously, the method defined by the configuration method was not\ncalled. This changes get_password_reset_key to call it.",
"is_bot": false,
"headline": "Make get_reset_password_key configuration method in reset_password fe…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-06-10T20:56:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3f45ec2c8be688ba1c01fe03c978112fa83a331f",
"body": "…as expected\n\nPreviously, the configuration method defined a method that was not\ncalled. This changes the implementation to call the defined method.",
"is_bot": false,
"headline": "Make unlock_account_key configuration method in lockout feature work …",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-06-10T20:54:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "374614191e7efa946d6d19934d42137ff42154a8",
"body": "…ork as expected\n\nThis was the opposite of convert_token_id, where the default method is\nprefixed with an underscore, but the configuration method created\na method not prefixed by an underscore.",
"is_bot": false,
"headline": "Make sms_request_response configuration method in sms_codes feature w…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-06-10T20:52:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c4ef452071e2363dc5df0332cbd61f5b0702e013",
"body": "Previously, convert_token_id was defined as an auth_private_method,\nso it defined a method that started with an underscore, but the\nactual method does not start with an underscore, so using the\nconfiguration method defined an unused method.",
"is_bot": false,
"headline": "Make convert_token_id configuration method work as expected",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-06-10T20:50:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fe7f2fd00dc381730812792078037e6c69aec98d",
"body": null,
"is_bot": false,
"headline": "Bump version to 2.44.0",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-06-08T16:04:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fdd4314526f830b67318a75a026272a77187773e",
"body": null,
"is_bot": false,
"headline": "Add nocov markers around code for older rack versions",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-06-01T14:14:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be6daa898d3d5d8eabc091103729cec0346e9f69",
"body": null,
"is_bot": false,
"headline": "Update CHANGELOG",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-06-01T14:08:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9cb5bf05c9560c9df7dee88ca56a7dbd2b0bb3e0",
"body": null,
"is_bot": false,
"headline": "Conditionally require rack in base feature so Rack.release is defined",
"author_name": "Yuki Fukuma",
"author_login": "fkmy",
"committed_at": "2026-06-01T05:57:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6018eb0ce784ca2a00fc7b9ee4e39be9a5e9b8a3",
"body": "…hod is added\n\nWhen adding SMS, TOTP, or WebAuthn authentication, if two factor\nauthentication is not already setup, and the active_sessions feature\nis in use, clear other active sessions. This prevents an active\nsession that was only single factor authenticated from being valid\nwhen two factor authentication is enabled.\n\nWhile the previous behavior is not considered a vulnerability, since\nthe session was fully authenticated when it was created, this seems\nlike a more secure default.",
"is_bot": false,
"headline": "Clear other active sessions when first multifactor authentication met…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-05-28T19:21:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "67948f992a830e01594f5fee56fa394d9f5ce4af",
"body": "This changes Rodauth::Auth classes to use a shape-friendly approach\nwhen YJIT is available. It assumes that if you care about performance,\nyou will be using YJIT if it is available, and using Ruby 3.2+.\nOn Ruby <3.2 or when YJIT is not available, the shape friendly\napproach is not used, so the only \n[…]\ny remaining use of\n`instance_variable_defined?` is in the soft-deprecated\n`auth_cached_method` method.\n\nIn the json feature, json_request? previously returned an integer;\nit now returns true or false.",
"is_bot": false,
"headline": "Use a shape-friendly approach on Ruby 3.2 with YJIT available",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-05-27T00:11:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "490384cae55ddd118a647a4ffdf1465c853748fd",
"body": null,
"is_bot": false,
"headline": "Add Add JRuby 10.1 to CI",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-05-25T17:13:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "665751bf721fc023123f8630f632b55f9827500a",
"body": null,
"is_bot": false,
"headline": "Fix typos in README.rdoc",
"author_name": "Tomás Miguez",
"author_login": "tomasmiguez",
"committed_at": "2026-04-30T18:45:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0ccc349af97f4ca867e9b8de1e82611dcf75edf4",
"body": "CI for these Ruby versions is currently broken due to a temporary\nissue in Rack breaking support in these Ruby versions.\n\nOnly test rack-head on Ruby 4.0+.\n\nUpdate CHANGELOG.",
"is_bot": false,
"headline": "Unbreak CI on Ruby 2.4/2.5",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-04-28T02:29:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "42d07363207b6be4ff3ece9a08446f27b3bef7bb",
"body": "In order to log failed login attempts, add a callback for a non-matching logins.\n\nUsage:\n\n after_no_matching_login do\n logger.info \"Failed login attempt for #{login_param_value}\"\n end",
"is_bot": false,
"headline": "Add after_no_matching_login hook",
"author_name": "Jonas Mueller",
"author_login": null,
"committed_at": "2026-04-20T06:32:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d9c82c88d7fe8611b4d3e070d3a72d99b9f08ce8",
"body": null,
"is_bot": false,
"headline": "Fix web link to reset_password_verifies_account feature",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-03-20T14:51:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6236811913899dba4a67b0d8577f0896de709c63",
"body": null,
"is_bot": false,
"headline": "Bump version to 2.43.0",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-03-20T14:32:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2c9c07d12be05de8d2dbb9e667110e8160688fde",
"body": "This doesn't actually matter except for documentation purposes,\nbecause SQLite doesn't treat json and jsonb differently.\n\nWhile here, have MySQL use the json type when testing in CI.",
"is_bot": false,
"headline": "Use jsonb as json type in migrations on SQLite 3.45+",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-03-18T17:41:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e62ee062112e1a9739a8781025324df821962d0c",
"body": "…ccount_id\n\nIf you are allowing account deletions, you probably shouldn't have\na foreign key in the audit log, as it would mean you would either\nhave to delete the audit log records before deleting the account,\nor you couldn't delete the account.\n\nBy default, Rodauth doesn't support account deletions. The\nclose_account feature does not delete accounts on close by default.\nHowever, it can be configured to do so.",
"is_bot": false,
"headline": "Mention not using foreign key for account_authentication_audit_logs.a…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-03-18T17:32:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7184dd87a4c56689201aaef5cd0dd28df7c455a7",
"body": null,
"is_bot": false,
"headline": "Bump copyright year",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-03-14T20:10:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ea5a5f65cccec961af975d3ab2b16db26897fb5",
"body": null,
"is_bot": false,
"headline": "Update to actions/checkout@v6",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-03-14T20:10:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc8aaf39020cd0f55e516a0e4a4b83e04992b76b",
"body": "This moves the related code from the reset_password feature to its own\nfeature, so that users only have to pay the cost for the feature if\nthey are using it.\n\nUpdate the spec to provide 100% coverage.",
"is_bot": false,
"headline": "Add reset_password_verifies_account feature",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2026-02-21T18:42:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa7b398877d8bf2bd4a08be9bb6e83a10d1975ea",
"body": null,
"is_bot": false,
"headline": "Removing errant editor autoformatting.",
"author_name": "Mike Manfrin",
"author_login": "manfrin",
"committed_at": "2026-01-28T18:45:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15ed86e4a16a5ad2d38ea030916d66df6609f723",
"body": null,
"is_bot": false,
"headline": "Adding documentation for reset_password_implicily_verifies? option.",
"author_name": "Mike Manfrin",
"author_login": "manfrin",
"committed_at": "2026-01-28T18:39:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e1ff38ab55fe8ee65d27f8aeee8d1d5c0cda0a9",
"body": "…unt on successful password reset.",
"is_bot": false,
"headline": "If reset_password_implicitly_verifies? is set to true, verify an acco…",
"author_name": "Mike Manfrin",
"author_login": "manfrin",
"committed_at": "2026-01-28T18:37:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1df3182fedf510c181b57a649d375a068290d35a",
"body": "…r password successfully reset.",
"is_bot": false,
"headline": "Adding tests for the implicit verification of accounts that have thei…",
"author_name": "Mike Manfrin",
"author_login": "manfrin",
"committed_at": "2026-01-28T18:37:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5eb5cb1697bc966b312421a75dab7679bcc7e2bd",
"body": "...to reduce redundancy",
"is_bot": false,
"headline": "Combine feature documentation into features section",
"author_name": "Judah Meek",
"author_login": "Judahmeek",
"committed_at": "2026-01-08T00:44:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "30cae38fb338b64a13c501f4515483f7d4896759",
"body": null,
"is_bot": false,
"headline": "Add Ruby 4.0 to CI",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-12-22T00:49:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8c07562f8c481b514dcbd42cc0cc5827699f8daf",
"body": null,
"is_bot": false,
"headline": "Bump version to 2.42.0",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-12-18T20:18:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3724d1cc7b9e9cdb386d183f74197af6fad672c5",
"body": null,
"is_bot": false,
"headline": "Avoid mixed string/symbol keys in JSON in a few specs",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-11-18T04:05:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e067e0bce6189fd1dce5c4eccddf593ab417ae4d",
"body": "…ture\n\nThese results in warnings in Ruby 4.0, and will eventually result\nin errors when using version 3+ of the json gem.",
"is_bot": false,
"headline": "Avoid mixed string/symbol keys in JSON when using the jwt_refresh fea…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-11-18T04:04:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "42a3682ab72b7c0687b49bfdf79db931fe05fe72",
"body": null,
"is_bot": false,
"headline": "Bump version to 2.41.0",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-10-08T15:10:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f01bab524499eef21a21d83a9883a60a41dc0aeb",
"body": "Previously, the only account change that cleared all account tokens\nwas closing the account. If you reset your password, only the reset\npassword token was cleared, if you verified a login change, only the\nverify login change token was cleared, etc. This changes the default\nbehavior to clear most acc\n[…]\nh refresh token is for the\ncurrent session. Potentially that ability could be added in the\nfuture, but this issue is simple to address by using the\nactive_sessions feature, so recommend that approach.",
"is_bot": false,
"headline": "Clear account tokens when an account change is made",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-09-29T20:10:10Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0cee9cb73657211d1cd35a6f3aba99fb1ddbfa68",
"body": "Using a string is almost always a bad idea, because if any part of\nthe path contains the string, it will filter out the path. Switch\nto using a block and doing a match on the entire path prefix.",
"is_bot": false,
"headline": "Use SimpleCov.add_filter block instead of string",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-08-22T22:01:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb9159806111ef5d420aec6fd8e811fdb658a7cd",
"body": null,
"is_bot": false,
"headline": "Bump version to 2.40.0",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-08-22T18:24:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a1780cd64e947d4531771e272ed97eb4f33058b9",
"body": "…page\n\nThis previous had the meta tag in the body, which not all browsers\nmay support. Hopefully using an actual HTTP header improves\ncompatibility.\n\nThis adds a otp_unlock_not_available_set_refresh_header configuration\nmethod for setting the header. The otp_unlock_refresh_tag configuration\nmethod is kept for backwards compatibility. It is no longer called by\ndefault, but users may still be calling it in their custom templates.",
"is_bot": false,
"headline": "Use HTTP header instead of meta tag for otp unlock not yet available …",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-07-29T18:39:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b39fa40e68d1dba819a83f03e2b3e8bfd3478cb",
"body": "This allows for configurable behavior, instead of always showing an\nerror on the login parameter.",
"is_bot": false,
"headline": "Add reset_password_request_for_unverified_account configuration method",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-07-14T15:47:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "588b865cf70c7f327f0f24a4e277dfe787a6674f",
"body": null,
"is_bot": false,
"headline": "Bump version to 2.39.0",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-05-22T18:52:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f86ed780281d9066e8df50872d345e9739e9664",
"body": null,
"is_bot": false,
"headline": "Add nocov around rack < 3 code",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-05-21T18:34:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ffed74a4f26867db18da0b77ea3dc8bead7e669e",
"body": "Looks like bundler executes platforms :jruby blocks even if not\nrunning JRuby.",
"is_bot": false,
"headline": "Check if JRUBY_VERSION is defined",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-05-21T17:50:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "68e802b9c2a53f5e65e7380281e0bb91af790879",
"body": "Limiting it on JRuby 10 breaks things.",
"is_bot": false,
"headline": "Only limit racc version on JRuby <10",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-05-21T17:46:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ccb0780d05d813dd3c7af54659862fdeb515e609",
"body": null,
"is_bot": false,
"headline": "Add JRuby 10.0 to CI",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-05-21T17:28:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f46561d301d5baa40d208dea20d1cd22faefdf39",
"body": "Now that Rack.release is checked in the code, this needs to be\nadded. In normal Rodauth usage, Rodauth is only loaded by\nRoda, which loads rack, so Rack.release is already required\nat that point.",
"is_bot": false,
"headline": "Fix check_method_doc task",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-05-09T20:33:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c4343e06bdddb8e526d4a536c2362a04e080797d",
"body": "With rdoc moving out of stdlib in Ruby 3.5, this could cause issues\nwith usage of bundle exec in CI. It's also an unnecessary require\nin the vast majority of cases, slowing down the Rakefile.\n\nSwitch to using a normal task. In addition to being faster, I think\nthis is easier to understand. This j\n[…]\nc. Doesn't seem necessary to have a separate\ntask to generate into rdoc.\n\nNote that the task itself requires rdoc, so actually generating the\ndocumentation make not work if you are using bundle exec.",
"is_bot": false,
"headline": "Remove use of rdoc/task in Rakefile",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-05-09T20:19:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1a2fe67c110e86ec1e41bbc30fa6b2e46bfd97a4",
"body": "Capybara 3.40 has fixed the issues when testing with Rack::Lint.",
"is_bot": false,
"headline": "Switch Ruby 3+ CI capybara version to be lower bound and not upper bound",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-05-09T20:13:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0ffbcbcb368f0d38f9c2d8f13f9235d2b9ee6d64",
"body": "Forgot to bump this when I added CI for Ruby 3.2, 3.3, and 3.4.",
"is_bot": false,
"headline": "Only test against rack head on Ruby 3.4+",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-05-09T20:13:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6b853d8eabfbebe8b6036c55282fe0aae09a90ab",
"body": "This changes Rodauth to use lower-case headers internally. For\nbackwards compatibility on Rack < 3, the lower-case headers are\nswitched to mixed-case headers. This isn't needed on Rack 3+, because\non Rack 3+, response headers are always lower case. Roda has been\nhandling this transparently, as it\n[…]\nf lower case to mixed case, keep the specs in mixed case, and\nadd a header spec method to convert mixed case to lower case. Also\nadd a CONTENT_TYPE_KEY constant, which is used for setting the header.",
"is_bot": false,
"headline": "Allow usage with Roda's plain_hash_response_headers plugin and Rack 3+",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-05-09T19:07:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "84833ee367eec7df3efe61bcb09c248b4699b41d",
"body": "…rty.new to avoid deprecation warning in webauthn 3.4.0+",
"is_bot": false,
"headline": "Use allowed_origins instead of origin argument to WebAuthn::RelyingPa…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-04-22T20:04:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d3535635ad2bd01042ce54094a68ef9f53171990",
"body": "…precation warning in recent json versions",
"is_bot": false,
"headline": "Change JSON.fast_generate to JSON.generate in jwt feature to avoid de…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-04-22T20:02:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f91bb0f1b9c3241144856f7b6cadd978d69b4864",
"body": "sucessful ==> successful\nUnsucessful ==> Unsuccessful\nabsense ==> absence\nauthenicator ==> authenticator\ncolummn ==> column\nchosing ==> choosing\nspeficiation ==> specification\nrepresentating ==> representing\nremebering ==> remembering",
"is_bot": false,
"headline": "Fix typos in doc",
"author_name": "fkmy",
"author_login": "fkmy",
"committed_at": "2025-04-07T14:36:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7c49c42dca81650f251fff93744cd84d2498d4e6",
"body": null,
"is_bot": false,
"headline": "Fix typo in README",
"author_name": "fkmy",
"author_login": "fkmy",
"committed_at": "2025-04-07T07:20:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a72b30136c512ea2853ad9dbc126c067bef89e9",
"body": "…h size when using login_return_to_requested_location?\n\nReturning to requested location is a nice to have, but not a hard\nrequirement, and few legitimate cases will exceed the limit. Not\nhaving a limit allows an easy way to unauthenticated users to force\ncookie too large exceptions in applications.\n\nThis adds a login_return_to_requested_location_max_path_size\nconfiguration method to change the limit.",
"is_bot": false,
"headline": "Avoid exceeding 4K cookie size limit by setting an upper limit on pat…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-03-31T19:11:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d44ae3c3962b747af01a219b34570898f9eb8660",
"body": null,
"is_bot": false,
"headline": "Conclude registration field guide fix (#472)",
"author_name": "AviFS",
"author_login": "AviFS",
"committed_at": "2025-03-16T06:31:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "abfe018e0522376a6291f8eaf34c76b844846193",
"body": null,
"is_bot": false,
"headline": "Fix code in registration field guide, again",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-03-15T22:44:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "08066c7a2181b3e006a8d6a55aa0e9c35014a011",
"body": null,
"is_bot": false,
"headline": "Fix code in registration field guide",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-03-15T22:12:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a677c083c494754d5eaf157db613588e899f46a8",
"body": "This shows gives an example of validating the field is not empty,\nbut with a comment so the user has a hint about how to do custom\nvalidation.",
"is_bot": false,
"headline": "Update registration field guide (Fixes #472)",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-03-15T16:32:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7f9404a7d240d5b8527af438daa5f4270800e3c5",
"body": "…gelog",
"is_bot": false,
"headline": "docs: `configuration_eval` -> `configuration_module_eval` in old chan…",
"author_name": "Bo Jeanes",
"author_login": "bjeanes",
"committed_at": "2025-02-23T23:01:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "994d68bba913db23509b1507e77c855c51b68e8a",
"body": null,
"is_bot": false,
"headline": "docs: `configuration_eval` -> `configuration_module_eval` in README",
"author_name": "Bo Jeanes",
"author_login": "bjeanes",
"committed_at": "2025-02-23T23:00:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "47d4c1661de5c8c4020d17fa20644b172e73e39b",
"body": null,
"is_bot": false,
"headline": "Bump version to 2.38.0",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-01-15T18:52:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f711fdd7bc8efbce2a4caad6afb68aedbb6aecc5",
"body": "It appears to have keyword argument issues that do not affect\nJRuby 9.1, 9.2, or 9.4.",
"is_bot": false,
"headline": "Drop JRuby 9.3 CI",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-01-15T01:06:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5631d5cd21705141c9d6ae36ad5b1bd0891bcd82",
"body": "…uired keyword arguments\n\nRuby 1.9 doesn't support keyword arguments at all, but the\n:fixed_locals option is only recognized on Tilt 2.6+, which requires\nRuby 2.0+.",
"is_bot": false,
"headline": "Make fixed locals support work on Ruby 2.0, which doesn't support req…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-01-14T19:49:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9a94aaddc8622fd773f72ded6f4c15c210946d74",
"body": "…support\n\nIf running Tilt with support and Roda without support for fixed\nlocals, Roda will use compiled methods that support fixed locals,\nbut try calling them with a single positional argument.",
"is_bot": false,
"headline": "Skip fixed locals spec if running Tilt with support but Roda without …",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-01-13T17:14:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a13d39aac99e9d2126deb94c3fa62f5db1d51fb5",
"body": "…tory_text calls verify_account_email_recently_sent?\n\nThis can happen in Rodauth configurations that want to suppress\nthe notice if the account has not sent the email recently.\n\nThis makes verify_account_email_recently_sent? return falsely if\nthere is no associated account, such as when the page is \n[…]\n response to an account\ncreation or login attempt. Note that if there is no account,\nthe warning should be displayed, because at that point you do not\nknow whether the email was sent recently or not.",
"is_bot": false,
"headline": "Make verify-account-resend page work if verify_account_resend_explana…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-01-10T19:06:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "714c082a543cba385fb94da7b6c1cde6abcdee84",
"body": "Use ubuntu-22.04 for Ruby 1.9.3 and JRuby 9.1/9.2.\n\nUse sequel-postgres-pr instead of pg on Ruby 1.9-2.3, since\nthe pg gem segfaults consistently on ubuntu-latest in CI on\nthose versions.",
"is_bot": false,
"headline": "Try to run most of CI on ubuntu-latest",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-01-07T01:14:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b32a4e32c0315d17f9bc457ba0469f6356d79765",
"body": null,
"is_bot": false,
"headline": "Cover default over_max_bytesize_param_value method",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-01-06T23:38:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "506caa49d48708f759e63628e3dc69c9b4beb57b",
"body": "…use_template_fixed_locals? false\n\nThis is designed to work with the fixed locals support added to\nRoda, in applications that specify default fixed locals for\ntemplates using the :template_opts option to Roda's render\nplugin. A recommended practice for Roda going forward is to\nspecify that template\n[…]\nls, and for those cases, the\nuse_template_fixed_locals? false configuration method can be used.\n\nIf the Roda and Tilt versions support fixed locals, this run the\ntests with fixed locals on by default.",
"is_bot": false,
"headline": "Specify fixed locals for rendered templates by default, disable with …",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2025-01-06T23:38:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "14a5e38f0709e3d35ea0572fcb3117ce9c782bbc",
"body": null,
"is_bot": false,
"headline": "Add Ruby 3.4 to CI",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-12-28T01:38:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c6e0700002e6967e545964ca1eb5ecc8c59ea05c",
"body": null,
"is_bot": false,
"headline": "Update CHANGELOG",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-12-26T23:24:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bb37118a47a13dd74c2be0a370da398fdb554313",
"body": "I needed this method when integrating rodauth-omniauth into our project.\n\nIf an account is created via omniauth, it doesn't have a password. In\nthis case, I prefer to display \"Create Password\" instead of \"Change\nPassword\".\n\nAdditionally, if the omniauth provider is the last authentication\nmethod, including the password, I aim to block to disconnect it.\n\nTherefore, I believe this method is beneficial to have in public.",
"is_bot": false,
"headline": "Make rodauth.has_password? method public",
"author_name": "Enes Cakir",
"author_login": "enescakir",
"committed_at": "2024-12-26T23:23:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3921088526dd034a26b685ce2704a46e2b7c3d3c",
"body": "This version made the `JWT::VERSION::{MAJOR,MINOR,TINY,PRE}` constants private,\nso we use `JWT.gem_version` instead.",
"is_bot": false,
"headline": "Fix compatibility with JWT 2.10+",
"author_name": "Janko Marohnić",
"author_login": "janko",
"committed_at": "2024-12-26T20:02:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "410ef7ca6883e78e01d0a69e5d708682f6047acd",
"body": "Run the specs with -W:strict_unused_block on Ruby 3.4 to more\neasily catch future issues.",
"is_bot": false,
"headline": "Fix strict_unused_block warnings when running specs on Ruby 3.4",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-12-18T00:34:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5bd816adf6252dca28465d5030e2484e04ed6120",
"body": "This affects the following methods:\n\n* email_auth_email_recently_sent?\n* unlock_account_email_recently_sent?\n* reset_password_email_recently_sent?\n* verify_account_email_recently_sent?\n\nThis provides a supported method for the user to check whether\nthe related emails have been recently sent.",
"is_bot": false,
"headline": "Make rodauth.*_email_recently_sent? methods public",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-12-17T21:16:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "589aac5b0dbbc318112c03ce74110a5212400569",
"body": null,
"is_bot": false,
"headline": "Update CHANGELOG",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-12-13T05:14:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7ec0a5467d05f73768c514b56547c603c644a3b0",
"body": null,
"is_bot": false,
"headline": "Reuse the new configuration error in other places",
"author_name": "Janko Marohnić",
"author_login": "janko",
"committed_at": "2024-12-12T14:29:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d2dd801872311c11454ccf747953550e2e56a44a",
"body": null,
"is_bot": false,
"headline": "Raise error when attempting to render, but rendering was disabled",
"author_name": "Janko Marohnić",
"author_login": "janko",
"committed_at": "2024-12-12T14:23:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "830148b2537b287274b3d47db8938e1efa42a038",
"body": null,
"is_bot": false,
"headline": "Add guide on customizing email requirements",
"author_name": "Janko Marohnić",
"author_login": "janko",
"committed_at": "2024-12-10T22:48:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c85e485eaac9d281ee0fd2b10c5b12a7fbac3779",
"body": "This repository has moved:\r\n\r\n> Project 'honeyryderchuck/rodauth-oauth' was moved to 'os85/rodauth-oauth'. Please update any links and bookmarks that may still have the old path.",
"is_bot": false,
"headline": "Update external link to rodauth-oauth",
"author_name": "Bradley Schaefer",
"author_login": "soulcutter",
"committed_at": "2024-11-19T20:36:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e86c3bdbca915d7485cc960c5a637ded127b956e",
"body": null,
"is_bot": false,
"headline": "Fix typo in 2.37.0 release notes",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-19T18:34:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb11b615c330652976696cff6c765563c42ad99d",
"body": null,
"is_bot": false,
"headline": "Bump version to 2.37.0",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-19T17:20:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6bfb93dfcb46f036ba75bba3d412233e6a5eeb70",
"body": "…ariables",
"is_bot": false,
"headline": "Spec helper fixes to work with SESSIONS/RODA_ROUTE_CSRF environment v…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-19T17:20:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc116db3a6be4095a541722f18c121ced41b4360",
"body": null,
"is_bot": false,
"headline": "Update CHANGELOG and README",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-18T18:13:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5de5d687ef58164b13f38db021983223e5959e80",
"body": "…ncase by default\"\n\nThis reverts commit eabfa697e9cf1871d6468c9940685579ad568b6d.\n\nInstead of having a separate feature for this simple configuration\nchange, we can just point people to the guide added in the previous\ncommit.",
"is_bot": false,
"headline": "Revert \"Add a downcased_logins feature, for normalizing logins to dow…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-18T18:09:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9a5fd583d1746cbff454337a305a1d7d1700c9e7",
"body": null,
"is_bot": false,
"headline": "Add guide for configuring case insensitive logins",
"author_name": "Janko Marohnić",
"author_login": "janko",
"committed_at": "2024-11-18T18:09:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a9adcd610844fb4c88163446e43a6b1df6bb5daa",
"body": "…etup",
"is_bot": false,
"headline": "Add method that returns whether 2nd factor is not authenticated but s…",
"author_name": "Janko Marohnić",
"author_login": "janko",
"committed_at": "2024-11-18T09:35:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eabfa697e9cf1871d6468c9940685579ad568b6d",
"body": "… default\n\nThis can be used to get case-insensitive login behavior on SQLite.\nThat's the default on other databases, at least in default\nconfigurations.\n\nThis cannot be made the default on SQLite, as it would break\nexisting installations, which may already have uppercase logins.",
"is_bot": false,
"headline": "Add a downcased_logins feature, for normalizing logins to downcase by…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-17T01:47:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d22ac7d346a700fce6466cad97a8943c383f8372",
"body": "…gin parameters\n\nThis returns the submitted value by default, but allows for user\nprovided normalization.",
"is_bot": false,
"headline": "Add normalize_login configuration method for normalizing submitted lo…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-17T01:25:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6424ce7ead4cd51ea695d355ab6ea010296dbf82",
"body": "Add login_confirmation_matches? configuration method to allow for case-sensitive login confirmation.",
"is_bot": false,
"headline": "Perform a case-insensitive login confirmation by default",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-17T01:05:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff12e9073c4da5fa7cb0a9f7a98d081c7221ce01",
"body": null,
"is_bot": false,
"headline": "Update CHANGELOG",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-12T22:47:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "306806532ba818c068ea06172c5800ee8f5ac4a2",
"body": "Currently, CSRF protection is only disabled for JWT requests, which use\ntoken-based instead of cookie-based authentication. However, JSON APIs\nthat require `Content-Type: application/json` and have reasonable CORS\nrestrictions don't appear to be vulnerable to CSRF attacks.\n\nSince handling CSRF tokens isn't trivial to do on the client side, we\ncan reduce friction by disabling CSRF protection by default for all\nJSON requests (including JWT).",
"is_bot": false,
"headline": "Disable CSRF protection for JSON requests",
"author_name": "Janko Marohnić",
"author_login": "janko",
"committed_at": "2024-11-12T21:42:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e88daabf3cfe7b525cb2228631b8ff5e1fdeb1e9",
"body": null,
"is_bot": false,
"headline": "Fix Ruby 1.9 support",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-08T18:39:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fa546e0fe5d120b6c5d55e718a58c362d80252b8",
"body": "…configuration to use\n\nThis makes it easier to use multiple Rodauth configurations in\nan application. Previously, you had to specify the alternate\nconfiguration name in every case where you were calling the method.\nThis allows you to set the configuration to use in a single place,\nso you can call rodauth and r.rodauth without arguments, and it\nwill pick up the desired configuration.",
"is_bot": false,
"headline": "Make rodauth and r.rodauth call default_rodauth_name for the default …",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-08T18:19:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b6f368b9fe82841afe88fa980bc937024602ee2c",
"body": "…or session in the jwt feature\n\nPreviously, if using Roda's session plugin and the Rodauth jwt\nfeature, when the Rodauth clear_session was called for a request\nthat should use JWT, it would call clear_session on the Roda\nscope. That is a mistake, because all Rodauth session\ninformation should be st\n[…]\n in a\nsession cookie.\n\nThis changes things so that Road scope clear_session is not called\nif JWTs are in use. It also makes it so that clear session does\nnot call session.clear twice in the JWT case.",
"is_bot": false,
"headline": "Make clear_session not call the scope's clear session if using JWTs f…",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-08T17:54:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4079fccdade8e0dd645ad692ee4e158562e0ffc1",
"body": null,
"is_bot": false,
"headline": "Simplify remove_cookie implementation in the specs",
"author_name": "Jeremy Evans",
"author_login": "jeremyevans",
"committed_at": "2024-11-08T17:52:17Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 75,
"commits_last_year": 42,
"latest_release_at": "2026-07-24T20:12:13Z",
"latest_release_tag": "2.45.0",
"releases_from_tags": true,
"days_since_last_push": 0,
"active_weeks_last_year": 18,
"days_since_latest_release": 0,
"mean_days_between_releases": 81.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 71,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "rodauth",
"exists": true,
"license": "MIT",
"keywords": [],
"ecosystem": "rubygems",
"matches_repo": true,
"registry_url": "https://rubygems.org/gems/rodauth",
"is_deprecated": false,
"latest_version": "2.45.0",
"repository_url": "https://github.com/jeremyevans/rodauth",
"versions_count": 75,
"total_downloads": 959480,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": "2015-08-12T15:33:14.093000Z",
"latest_published_at": "2026-07-24T20:24:40.073000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 111,
"stars": 1918,
"watchers": 26,
"fork_history": {
"days": [
{
"date": "2015-08-13",
"count": 1
},
{
"date": "2016-02-16",
"count": 1
},
{
"date": "2016-03-11",
"count": 1
},
{
"date": "2016-04-22",
"count": 1
},
{
"date": "2016-04-23",
"count": 1
},
{
"date": "2016-05-09",
"count": 1
},
{
"date": "2016-09-21",
"count": 1
},
{
"date": "2016-09-27",
"count": 1
},
{
"date": "2016-10-19",
"count": 1
},
{
"date": "2016-12-04",
"count": 1
},
{
"date": "2016-12-10",
"count": 1
},
{
"date": "2016-12-16",
"count": 1
},
{
"date": "2017-02-13",
"count": 1
},
{
"date": "2017-02-16",
"count": 1
},
{
"date": "2017-02-22",
"count": 1
},
{
"date": "2017-02-28",
"count": 1
},
{
"date": "2017-06-07",
"count": 1
},
{
"date": "2017-06-19",
"count": 1
},
{
"date": "2017-09-14",
"count": 1
},
{
"date": "2017-09-18",
"count": 1
},
{
"date": "2017-10-03",
"count": 1
},
{
"date": "2017-10-06",
"count": 1
},
{
"date": "2017-10-16",
"count": 1
},
{
"date": "2017-10-20",
"count": 1
},
{
"date": "2018-02-27",
"count": 1
},
{
"date": "2018-03-04",
"count": 1
},
{
"date": "2018-04-22",
"count": 1
},
{
"date": "2018-06-05",
"count": 1
},
{
"date": "2018-06-30",
"count": 1
},
{
"date": "2018-10-03",
"count": 1
},
{
"date": "2019-02-23",
"count": 1
},
{
"date": "2019-05-03",
"count": 1
},
{
"date": "2019-06-02",
"count": 1
},
{
"date": "2019-06-12",
"count": 1
},
{
"date": "2019-12-10",
"count": 1
},
{
"date": "2020-01-28",
"count": 1
},
{
"date": "2020-03-12",
"count": 1
},
{
"date": "2020-04-21",
"count": 1
},
{
"date": "2020-05-07",
"count": 1
},
{
"date": "2020-05-09",
"count": 1
},
{
"date": "2020-05-10",
"count": 1
},
{
"date": "2020-05-16",
"count": 1
},
{
"date": "2020-05-27",
"count": 1
},
{
"date": "2020-06-11",
"count": 1
},
{
"date": "2020-06-30",
"count": 1
},
{
"date": "2020-07-16",
"count": 1
},
{
"date": "2020-08-21",
"count": 1
},
{
"date": "2020-08-24",
"count": 1
},
{
"date": "2020-09-29",
"count": 1
},
{
"date": "2020-11-03",
"count": 1
},
{
"date": "2020-11-13",
"count": 1
},
{
"date": "2021-03-01",
"count": 1
},
{
"date": "2021-03-15",
"count": 1
},
{
"date": "2021-03-17",
"count": 2
},
{
"date": "2021-04-19",
"count": 1
},
{
"date": "2021-09-15",
"count": 1
},
{
"date": "2021-11-25",
"count": 1
},
{
"date": "2021-12-10",
"count": 1
},
{
"date": "2022-01-19",
"count": 1
},
{
"date": "2022-02-04",
"count": 1
},
{
"date": "2022-02-16",
"count": 1
},
{
"date": "2022-03-06",
"count": 1
},
{
"date": "2022-03-16",
"count": 1
},
{
"date": "2022-04-07",
"count": 1
},
{
"date": "2022-05-10",
"count": 1
},
{
"date": "2022-07-16",
"count": 1
},
{
"date": "2022-08-11",
"count": 1
},
{
"date": "2022-09-21",
"count": 1
},
{
"date": "2022-09-24",
"count": 1
},
{
"date": "2022-11-16",
"count": 1
},
{
"date": "2022-12-19",
"count": 1
},
{
"date": "2023-01-09",
"count": 1
},
{
"date": "2023-01-27",
"count": 1
},
{
"date": "2023-02-17",
"count": 1
},
{
"date": "2023-03-13",
"count": 1
},
{
"date": "2023-03-16",
"count": 1
},
{
"date": "2023-03-21",
"count": 1
},
{
"date": "2023-03-24",
"count": 1
},
{
"date": "2023-04-21",
"count": 1
},
{
"date": "2023-05-26",
"count": 1
},
{
"date": "2023-07-18",
"count": 1
},
{
"date": "2023-11-06",
"count": 1
},
{
"date": "2023-12-30",
"count": 1
},
{
"date": "2024-03-08",
"count": 1
},
{
"date": "2024-03-26",
"count": 1
},
{
"date": "2024-03-27",
"count": 1
},
{
"date": "2024-04-14",
"count": 1
},
{
"date": "2024-04-25",
"count": 1
},
{
"date": "2024-05-13",
"count": 1
},
{
"date": "2024-06-23",
"count": 1
},
{
"date": "2024-07-11",
"count": 1
},
{
"date": "2024-11-03",
"count": 1
},
{
"date": "2024-11-19",
"count": 1
},
{
"date": "2024-12-26",
"count": 1
},
{
"date": "2025-03-16",
"count": 1
},
{
"date": "2025-03-19",
"count": 1
},
{
"date": "2025-04-07",
"count": 1
},
{
"date": "2025-07-02",
"count": 1
},
{
"date": "2025-07-06",
"count": 1
},
{
"date": "2025-07-14",
"count": 1
},
{
"date": "2025-08-14",
"count": 1
},
{
"date": "2025-09-17",
"count": 1
},
{
"date": "2025-09-29",
"count": 1
},
{
"date": "2026-01-28",
"count": 1
},
{
"date": "2026-04-30",
"count": 1
},
{
"date": "2026-06-19",
"count": 1
},
{
"date": "2026-07-20",
"count": 4
}
],
"complete": true,
"collected": 111,
"total_forks": 111
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 106951,
"source_files_sampled": 112,
"oversized_source_files": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [],
"advisories": {
"error": "No resolved dependencies carried a version and a supported ecosystem",
"scope": "repository_graph",
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 15,
"direct_affected_count": 0
},
"ecosystems": [],
"dependencies": [],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "argon2",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "bcrypt",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "capybara",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "jwt",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "mail",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "minitest",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "minitest-global_expectations",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "minitest-hooks",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "rack_csrf",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "roda",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "rotp",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "rqrcode",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "sequel",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "tilt",
"direct": false,
"version": null,
"ecosystem": "rubygems"
},
{
"name": "webauthn",
"direct": false,
"version": null,
"ecosystem": "rubygems"
}
],
"collected": true,
"truncated": false,
"total_count": 15,
"direct_count": 0,
"indirect_count": 15
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 158,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 77,
"closed_unmerged_prs": 97
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "jeremyevans",
"commits": 1188,
"avatar_url": "https://avatars.githubusercontent.com/u/3846?v=4"
},
{
"type": "User",
"login": "janko",
"commits": 148,
"avatar_url": "https://avatars.githubusercontent.com/u/795488?v=4"
},
{
"type": "User",
"login": "adam12",
"commits": 13,
"avatar_url": "https://avatars.githubusercontent.com/u/17083?v=4"
},
{
"type": "User",
"login": "bjeanes",
"commits": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/2560?v=4"
},
{
"type": "User",
"login": "allavena",
"commits": 5,
"avatar_url": "https://avatars.githubusercontent.com/u/6095074?v=4"
},
{
"type": "User",
"login": "manfrin",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/1041921?v=4"
},
{
"type": "User",
"login": "fkmy",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/1322208?v=4"
},
{
"type": "User",
"login": "renchap",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/42070?v=4"
},
{
"type": "User",
"login": "jf",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/7270?v=4"
},
{
"type": "User",
"login": "Bertg",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/1434?v=4"
}
],
"contributors_sampled": 40,
"top_contributor_share": 0.84
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 8,
"reason": "4 out of 5 merged PRs checked by a CI test -- score normalized to 8",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 1,
"reason": "Found 5/30 approved changesets -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 17 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "21 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 9,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 10,
"reason": "GitHub workflow tokens follow principle of least privilege",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "758b7a565514178a8bbf6740f9694f4c7aec1e7f",
"ran_at": "2026-07-24T20:29:15Z",
"aggregate_score": 6.1,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-24T20:23:05Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-12T16:30:28Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/jeremyevans/rodauth",
"host": "github.com",
"name": "rodauth",
"owner": "jeremyevans"
},
"metrics": {
"overall": {
"key": "overall",
"band": "good",
"name": "Overall health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"security": 62,
"vitality": 76,
"community": 75,
"governance": 67,
"engineering": 70
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 76,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 73,
"inputs": {
"commits_last_year": 42,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 18
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "18/52 weeks with commits",
"points": 12.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 18
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "42 commits in the last year",
"points": 14.7,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 42
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "21 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "good",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 80,
"inputs": {
"releases_count": 75,
"latest_release_tag": "2.45.0",
"releases_from_tags": true,
"days_since_latest_release": 0,
"mean_days_between_releases": 81.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "75 version tags (no GitHub releases)",
"points": 16.2,
"status": "partial",
"details": [
{
"code": "version_tags_no_releases",
"params": {
"count": 75
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~81.2 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 81.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 0,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 0 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 0
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "good",
"name": "Community & Adoption",
"value": 75,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "good",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 78,
"inputs": {
"forks": 111,
"stars": 1918,
"watchers": 26,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "1,918 stars",
"points": 53.2,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 1918
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "111 forks",
"points": 17,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 111
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "26 watchers",
"points": 7.8,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 26
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "good",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 78,
"inputs": {
"packages": [
"rodauth"
],
"dependents": null,
"ecosystems": "rubygems",
"total_downloads": 959480,
"monthly_downloads": null
},
"components": [
{
"key": "total_downloads",
"name": "Total downloads",
"detail": "959,480 downloads all-time across rubygems",
"points": 62.2,
"status": "partial",
"details": [
{
"code": "downloads_total",
"params": {
"count": 959480,
"ecosystems": "rubygems"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 67,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 36,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 40,
"top_contributor_share": 0.84
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 84% of commits",
"points": 3.6,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 84
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "40 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 40
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 17 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 72,
"inputs": {
"merged_prs": 158,
"open_issues": 0,
"closed_issues": 77,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 97
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 46.8,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "158/255 decided PRs merged",
"points": 23.7,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 158,
"decided": 255
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 5/30 approved changesets -- score normalized to 1",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 73,
"inputs": {
"followers": 1742,
"owner_type": "User",
"is_verified": null,
"owner_login": "jeremyevans",
"public_repos": 239,
"account_age_days": 6694
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "1,742 followers of jeremyevans",
"points": 23.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 1742,
"login": "jeremyevans"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "239 public repos, account ~18 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 239
}
},
{
"code": "account_age_years",
"params": {
"years": 18
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"rodauth"
],
"ecosystems": "rubygems",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on rubygems",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "rubygems"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "75 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 75
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 70,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "1 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 1
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "4 out of 5 merged PRs checked by a CI test -- score normalized to 8",
"points": 16,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 80,
"inputs": {
"topics": [],
"has_wiki": false,
"homepage": "http://rodauth.jeremyevans.net",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "http://rodauth.jeremyevans.net",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 62,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 62,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 6.1
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "4 out of 5 merged PRs checked by a CI test -- score normalized to 8",
"points": 2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 5/30 approved changesets -- score normalized to 1",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 17 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "21 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "GitHub workflow tokens follow principle of least privilege",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 17
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "critical",
"name": "AI Readiness",
"value": 29,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "critical",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 26,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.48,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "48 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 25.6,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 48,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "critical",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 22,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [],
"has_dockerfile": false,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"primary_language": "Ruby",
"largest_source_bytes": 106951,
"source_files_sampled": 112,
"oversized_source_files": 1
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Ruby without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "Ruby"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "1/112 source files over 60KB",
"points": 54.5,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 112,
"oversized": 1
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"No resolved dependencies carried a version and a supported ecosystem"
],
"report_type": "repository",
"generated_at": "2026-07-24T20:29:34.279919Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/j/jeremyevans/rodauth.svg",
"full_name": "jeremyevans/rodauth",
"license_state": "standard",
"license_spdx": "MIT"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with jeremyevans/rodauth. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
