公开记录中等
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-26 22:34 UTC
kanywst / brtc
Cost calculator for offline password brute-force attacks: time + USD per GPU profile, with a CI gatekeeper.
kanywst/brtc 的健康指数为 100 分中的 58 分，处于「中等」区间。 其得分最高的类别是Vitality（81/100），最低的是Community & Adoption（24/100）。 最近一次更新在 6 天前。 近期的大部分工作由 1 位贡献者完成。
58
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
58
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
软件包生态系统
| 注册表 | 软件包 | 版本 | 月下载量 | 版本数 | 最近发布 |
|---|---|---|---|---|---|
| Go | github.com/kanywst/brtc | v1.3.0 | - | 4 | 7 天前 |
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
81
开发活跃度
69中等
评分方式
| 36/36 | 推送新近度 — 最近一次推送于 6 天前 |
| 4.8/36 | 提交节奏 — 52 周中有 7 周有提交 |
| 18/18 | 提交量 — 最近一年 106 次提交 |
| 10/10 | OpenSSF Scorecard：Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
所用输入
| commits_last_year | 106 |
| human_commit_share | 0.79 |
| days_since_last_push | 6 |
| active_weeks_last_year | 7 |
发布纪律
98优秀
评分方式
| 27/27 | 有发布版本 — 已发布 4 个发布版本 |
| 36/36 | 发布时效 — 最近一次发布版本于 7 天前 |
| 27/27 | 发布节奏 — 约每 44.4 天发布一次 |
| 8/10 | OpenSSF Scorecard：Signed-Releases — 1 out of the last 1 releases have a total of 1 signed artifacts. |
所用输入
| releases_count | 4 |
| latest_release_tag | v1.3.0 |
| releases_from_tags | 否 |
| days_since_latest_release | 7 |
| mean_days_between_releases | 44.4 |
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
24
流行度与采用
1危急
评分方式
| 0/60 | 星标 — 0 个星标 |
| 0/25 | 复刻 — 0 个复刻 |
| 0/15 | 关注者 — 0 位关注者 |
所用输入
| forks | 0 |
| stars | 0 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
50中等
评分方式
| 22.5/22.5 | README |
| 22.5/22.5 | 许可证 — 可识别的许可证（MIT） |
| 0/18 | CONTRIBUTING 指南 |
| 0/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 0/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 是 |
| has_contributing | 否 |
| has_issue_template | 否 |
| has_code_of_conduct | 否 |
| has_pull_request_template | 否 |
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
52
维护者韧性（巴士系数）
13危急
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 0/22.5 | 提交分布 — 头号贡献者编写了 100% 的提交 |
| 1.4/13.5 | 贡献者广度 — 1 位贡献者 |
| 3/10 | OpenSSF Scorecard：Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
所用输入
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
议题与 PR 响应能力
69中等
评分方式
| 0/46.8 | 议题解决 — 没有议题或无数据 |
| 36.8/38.3 | PR 接受 — 已裁定的 PR 中 25/26 已合并 |
| 0/15 | OpenSSF Scorecard：Code-Review — Found 0/9 approved changesets -- score normalized to 0 |
所用输入
| merged_prs | 25 |
| open_issues | 0 |
| closed_issues | 0 |
| issue_closed_ratio | — |
| closed_unmerged_prs | 1 |
已排除计分（无数据或不适用）：议题解决。 其余权重已重新归一化。
所有权与托管责任
51中等
评分方式
| 10/30 | 所有权背书 — 个人（用户）账户 |
| 0/20 | 已验证域名 — 不适用于个人账户 |
| 6.9/25 | 所有者影响力 — kanywst 有 8 位关注者 |
| 23.9/25 | 既往记录 — 42 个公开仓库，账户约 7 年 |
所用输入
| followers | 8 |
| owner_type | User |
| is_verified | — |
| owner_login | kanywst |
| public_repos | 42 |
| account_age_days | 2,778 |
已排除计分（无数据或不适用）：已验证域名。 其余权重已重新归一化。
软件包维护
92优秀
评分方式
| 25/25 | 已发布且可解析 — go 上有 1 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 7 天前 |
| 12/20 | 版本历史 — 4 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | github.com/kanywst/brtc |
| ecosystems | go |
| any_deprecated | 否 |
| min_days_since_publish | 7 |
工程质量
基础的工程与文档实践是否到位？
76
工程实践
84良好
评分方式
| 24/24 | CI 工作流 — 3 个工作流 |
| 24/24 | 存在测试 |
| 16/16 | Linter 配置 — .golangci.yml |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 20/20 | OpenSSF Scorecard：CI-Tests — 6 out of 6 merged PRs checked by a CI test -- score normalized to 10 |
所用输入
| has_ci | 是 |
| has_tests | 是 |
| has_editorconfig | 否 |
| has_linter_config | 是 |
| has_precommit_config | 否 |
文档
65中等
评分方式
| 30/30 | README |
| 0/25 | 文档目录 |
| 15/15 | 文档 / 主页站点 — https://pkg.go.dev/github.com/kanywst/brtc |
| 10/10 | 仓库描述 |
| 10/10 | 主题标签 — 15 个主题标签 |
| 0/10 | Wiki |
所用输入
| topics | argon2, bcrypt, brute-force, bubbletea, cli, cost-calculator, devsecops, entropy, go, password-cracking, password-strength, sarif, security, tui, zxcvbn |
| has_wiki | 否 |
| homepage | https://pkg.go.dev/github.com/kanywst/brtc |
| has_readme | 是 |
| has_docs_dir | 否 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
53
安全态势
53中等
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 2.5/2.5 | CI-Tests — 6 out of 6 merged PRs checked by a CI test -- score normalized to 10 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/9 approved changesets -- score normalized to 0 |
| 0.8/2.5 | Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | 许可证 — license file detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 6/7.5 | Signed-Releases — 1 out of the last 1 releases have a total of 1 signed artifacts. |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 6.8/7.5 | Vulnerabilities — 1 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 18 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 0 |
| scorecard_aggregate | 5.3 |
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
69
AI 代理上下文与指引
40存在风险
评分方式
| 0/45 | 代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则 |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 79 次人类提交中有 79 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 1 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
评分方式
| 18/18 | 一条命令的引导启动 — Makefile |
| 22/22 | 自动化测试 |
| 11/11 | Lint / 格式化配置 — .golangci.yml |
| 11/11 | 静态类型检查 — Go（静态类型） |
| 10/10 | 可复现环境 — lockfile |
| 0/10 | 已体现的代理实践 — 最近 100 次提交中没有代理编写的提交 |
| 8/8 | 自动化维护 — 最近 100 次提交中有 8 次为自动依赖更新 |
| 0/10 | OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | go.sum |
| has_dockerfile | 否 |
| typed_language | 是 |
| bootstrap_files | Makefile |
| has_devcontainer | 否 |
| has_linter_config | 是 |
| typecheck_configs | — |
| agent_commit_share | 0 |
| toolchain_manifests | go.mod |
| dependency_bot_commit_share | 0.08 |
面向模型的代码可读性
100优秀
评分方式
| 45/45 | 可类型检查的代码 — Go（静态类型） |
| 55/55 | 可控的文件大小 — 采样的 35 个源文件中有 0 个超过 60KB |
所用输入
| primary_language | Go |
| largest_source_bytes | 12,770 |
| source_files_sampled | 35 |
| oversized_source_files | 0 |
关键数据
0GitHub 星标
1贡献者
106最近 12 个月提交数
6距最近推送天数
4发布版本数
1巴士系数（bus factor）
0开放议题
Go软件包生态系统数
数据采集警告
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
更多细节
OpenSSF Scorecard 5.3 / 10
5.3综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 10 | CI-Tests | 6 out of 6 merged PRs checked by a CI test -- score normalized to 10 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/9 approved changesets -- score normalized to 0 |
| 3 | Contributors | project has 1 contributing companies or organizations -- score normalized to 3 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 10 | Dependency-Update-Tool | update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| 8 | Signed-Releases | 1 out of the last 1 releases have a total of 1 signed artifacts. |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 9 | Vulnerabilities | 1 existing vulnerabilities detected |
直接依赖 5
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| Go | github.com/charmbracelet/lipgloss | v1.1.0 | go.mod |
| Go | github.com/mattn/go-isatty | v0.0.23 | go.mod |
| Go | github.com/spf13/cobra | v1.10.2 | go.mod |
| Go | github.com/trustelem/zxcvbn | v1.0.1 | go.mod |
| Go | gopkg.in/yaml.v3 | v3.0.1 | go.mod |
全部依赖 未采集
本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [
"argon2",
"bcrypt",
"brute-force",
"bubbletea",
"cli",
"cost-calculator",
"devsecops",
"entropy",
"go",
"password-cracking",
"password-strength",
"sarif",
"security",
"tui",
"zxcvbn"
],
"is_fork": false,
"size_kb": 5128,
"has_wiki": false,
"homepage": "https://pkg.go.dev/github.com/kanywst/brtc",
"languages": {
"Go": 98997,
"Makefile": 331
},
"pushed_at": "2026-07-20T01:57:28Z",
"created_at": "2026-03-08T05:06:44Z",
"owner_type": "User",
"updated_at": "2026-07-20T01:57:32Z",
"description": "Cost calculator for offline password brute-force attacks: time + USD per GPU profile, with a CI gatekeeper.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "https://kanywst.github.io/",
"name": "kt",
"type": "User",
"login": "kanywst",
"company": null,
"location": null,
"followers": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/45947799?v=4",
"created_at": "2018-12-17T17:39:10Z",
"is_verified": null,
"public_repos": 42,
"account_age_days": 2778
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.3.0",
"kind": "minor",
"published_at": "2026-07-19T13:28:26Z"
},
{
"tag": "v1.2.0",
"kind": "minor",
"published_at": "2026-06-24T13:40:45Z"
},
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-05-05T07:21:13Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2026-03-08T06:31:40Z"
}
],
"recent_commits": [
{
"oid": "245794bbdab261d3d40a9b12d15315fd41bc91b0",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-07-20T01:57:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7c621ac323a8502b44cb869dc74b360c1d08f970",
"body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/v6...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-go\n dependency-version: '7'\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump actions/setup-go from 6 to 7",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-20T01:55:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c409b000b36db707270a904e164f1a2a73a44118",
"body": "Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.22 to 0.0.23.\n- [Commits](https://github.com/mattn/go-isatty/compare/v0.0.22...v0.0.23)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/mattn/go-isatty\n dependency-version: 0.0.23\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-20T01:55:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea52f12745f46c0a146436bd4e53fa506a0b3f86",
"body": "The release job archives LICENSE and README.md via .goreleaser.yml, but\nno LICENSE file existed, so GoReleaser failed globbing for it. README and\nthe nfpm config already declare MIT; add the matching license text.",
"is_bot": false,
"headline": "chore: add MIT LICENSE file",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:21:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d4be1d0950b601776bb1f26085d9b67aaf87c696",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-07-19T13:17:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ee08d0d7d00fc6150d455cb4ba6ff5635a3088f",
"body": "NaN fails every ordered comparison, so an uncomputable crack time slid\ninto the green RESISTANT verdict and a 'NaN years' duration:\n\n- renderVerdict flags NaN as 'VERDICT: UNKNOWN' (critical) instead of\n falling through to the safe default.\n- FormatDuration maps NaN to the worst-case 'Less than a second' rather\n than 'NaN years'.\n- addThousands preserves a leading sign so a negative never becomes\n '-,123,456' (defensive; no caller passes negatives today).",
"is_bot": false,
"headline": "fix(ui): treat NaN durations as unsafe, not RESISTANT",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f5b2b96d06da580c9ab69ebb98053e5acb9ab82c",
"body": "Cap the connection-reuse drain at 1 MiB so a malicious or oversized\nresponse cannot pin the reading goroutine on an unbounded stream. A real\nrange response is only tens of KB.",
"is_bot": false,
"headline": "fix(hibp): bound the body-drain read with a LimitReader",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aed801c04aeb7f3e81d362396f555fb53ae3f483",
"body": "zxcvbn's pattern matching is super-linear on very long or highly\nrepetitive inputs, so an attacker-supplied megabyte string could pin a\nCPU. Truncate to 256 runes (rune-safe, never splitting a multi-byte\ncharacter) before analysis; anything longer is already unguessable, so\nno signal is lost.",
"is_bot": false,
"headline": "fix(zxcvbn): cap input length to bound analysis cost",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd43b75c4b257ca8e90d94ce5f42e3694de4c8cb",
"body": "- --hibp combined with --all-hw was silently dropped; reject it like the\n other single-profile flags, per the stated no-silent-drop principle.\n- A known-breached password now fails the --fail-under-time gate\n unconditionally, aligning the exit code with the COMPROMISED verdict.\n- Add cmd-level tests covering the flag-interaction guards.",
"is_bot": false,
"headline": "feat(cli): reject --hibp with --all-hw and fail the gate on a breach",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "db9355f110a823608ccddb360e0593c583587ae2",
"body": "Construct the default http.Client once instead of per Check call so the\ntransport can pool connections, and drain any unread response body\nbefore closing (countInBody returns early on a match) so the connection\nis reusable rather than dropped.",
"is_bot": false,
"headline": "perf(hibp): reuse a package-level client and drain the body",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b0934ecaa57394d2725f3ca9f1afdeec0d01c1f7",
"body": "…ounts\n\nAn astronomically long password overflows crack time to +Inf, which\npoisoned several output paths:\n\n- TotalCost now returns 0 for owned hardware instead of Inf*0 = NaN,\n which had rendered as $NaN and broke JSON marshaling.\n- FormatCost guards NaN (-> $0.00); MarshalJSON sanitizes +Inf/NaN\n\n[…]\nt every comparison and int(NaN) panicked strings.Repeat.\n\nAlso add FormatCount so breach counts print as exact integers with\nseparators (9,659,365) rather than a lossy humanScale (9.7 million /\n42.0).",
"is_bot": false,
"headline": "fix(ui): harden output against non-finite floats and integer breach c…",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c919935afdbd4c400db4d9e87489b0e67052de4b",
"body": "Address the Gemini review findings:\n\n- guessesToBigInt now maps a +Inf zxcvbn guess count to a 2^1024\n sentinel instead of letting big.Float.Int(nil) collapse it to 0,\n which had inverted an unguessable password into \"instantly\n crackable\". NaN / non-positive clamp to 0. Extracted as a pure\n hel\n[…]\n unit-tested.\n- countInBody returns a scan error instead of swallowing it, and\n Check propagates it, so a truncated response body no longer reports\n a breached password as \"not found in the corpus\".",
"is_bot": false,
"headline": "fix(review): handle zxcvbn +Inf and propagate HIBP scan errors",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "dd2414c1a8bfed6fffca4dd0173c397b78c75bea",
"body": "Refresh the pairing section for the built-in --zxcvbn analyzer and the\n--hibp breach check, add the AI-GPU cost-inefficiency note to the\nall-hw example (with current numbers), and mention the verdict banner\nand entropy gauge in Features.",
"is_bot": false,
"headline": "docs(readme): document 2026 refresh, --zxcvbn, --hibp, and new UX",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "228fd177af3416916d3d94a1d9efb74124c12bbc",
"body": "Add a --hibp flag and an internal/breach package that queries HIBP via\nthe k-anonymity range API: only the first 5 hex chars of the password's\nSHA-1 are sent, and the suffix is matched locally, so the plaintext\nnever leaves the machine. The lookup is opt-in and network failures are\nwarnings, not fat\n[…]\nt.\n\nA breached password overrides the verdict banner to COMPROMISED\nregardless of entropy (the attacker looks it up rather than cracking\nit), and the count surfaces in the TUI, table, and JSON output.",
"is_bot": false,
"headline": "feat(hibp): add opt-in Have I Been Pwned breach check",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8ef767c45d8919baf434f2c37183b40d911dba31",
"body": "Add a --zxcvbn flag that runs Dropbox's zxcvbn (trustelem/zxcvbn port)\nover the password and feeds its guess count through the existing\nFromGuesses pipeline, instead of the naive R^L entropy. This closes the\ntool's headline gap: naive entropy rates \"P@ssw0rd!\" at ~1.6M years,\nwhile zxcvbn correctly \n[…]\ns crackable in under a second.\n\n--zxcvbn and --guesses are mutually exclusive; budget/recommendation\nmath (which needs a charset) is skipped for both external estimates via\na shared haveCharset guard.",
"is_bot": false,
"headline": "feat(zxcvbn): add built-in pattern-aware strength estimation",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ded2c3dac1c60f2dd6599c39f5b5af63899accb0",
"body": "NIST SP 800-63B-4 (2025) de-emphasizes character-space entropy for\nhuman-chosen passwords. Add EntropyModelNote so every output surface\n(TUI footnote, table trailer, and a new entropy_model JSON field)\nstates that the default figure is an R^L brute-force upper bound\nassuming a random password, and points at the pattern-aware --guesses\npath; the note switches wording when an external guess count is used.",
"is_bot": false,
"headline": "feat(ui): label entropy as a random-password upper bound",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa1c17c080d3f7835a6df36cecef69e414954678",
"body": "Replace raw digit walls with legible formatting across the TUI, table,\nand matrix views:\n\n- FormatDuration collapses huge year counts to short-scale words and\n anchors anything past ~13.8Gyr against the age of the universe, so\n \"2414613469377.2 years\" becomes \"1.3 trillion years (95x ...)\".\n- Form\n[…]\nillion), and \"< $0.01\" so a\n trivially cheap crack no longer reads as free ($0.00).\n- The TUI gains a one-line coloured VERDICT headline and an entropy\n gauge bar so strength is legible at a glance.",
"is_bot": false,
"headline": "feat(ui): humanize numbers and add a verdict banner + entropy gauge",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c1d6a6cc85373fd1081d3f400307e3371e135850",
"body": "Add RTX 5090 (Blackwell) and RX 7900 XTX profiles, add sha1/ntlm\nhashrates to every profile, and correct several stale figures:\n\n- rtx-4090 bcrypt cost-5 was ~1.8x too slow (100k -> 184k H/s).\n- aws-p5.48xlarge (8x H100) was ~4x overstated; AI datacenter GPUs\n are poor crackers (integer/bitwise, no\n[…]\nx-4090 rental bumped to $0.35/hr per 2026 marketplace pricing.\n\nExpose sha1/ntlm via --algo and the two new profiles via --hw. Update\nREADME, CLAUDE.md gotchas, and the completeness tests accordingly.",
"is_bot": false,
"headline": "feat(data): refresh hardware baselines to 2026 hashcat numbers",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-07-19T13:15:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "588f1e8b4b39c3fe5cea355956e46146d9875846",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-06-29T13:43:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "798f838d89e6afc60132e2108b018bfbb18ffa9d",
"body": "Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.20 to 0.0.22.\n- [Commits](https://github.com/mattn/go-isatty/compare/v0.0.20...v0.0.22)\n\n---\nupdated-dependencies:\n- dependency-name: github.com/mattn/go-isatty\n dependency-version: 0.0.22\n dependency-type: direct:production\n update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "chore(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.22",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-29T13:40:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0bd4ae99f32901619678fa29c2c58b01eae7754a",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-06-24T10:03:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "25b9513d03f71958223883d8788dbd9c8754e8b5",
"body": "The clamp test only checked for a negative result, so it would have passed on\nany non-negative value; assert == 0 to actually verify the clamp.",
"is_bot": false,
"headline": "test(budget): assert tiny-budget length is exactly 0",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T10:01:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "110b88dc6ba84a2c3ad5c9f9c8acaa54c9c6130f",
"body": "An astronomically large budget overflowed the 2*T*H product to +Inf, making\nthe int cast garbage. Sum the logarithms instead so the result stays finite.",
"is_bot": false,
"headline": "fix(budget): compute max length via log sum to avoid float overflow",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T10:01:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "48c8633827218ebdef89bb76dfabe11cd3021d2f",
"body": "A budget too small to afford even one character produced a negative floor,\nwhich leaked a negative budget_max_chars into JSON. Clamp the result to 0.",
"is_bot": false,
"headline": "fix(budget): clamp MaxLengthForBudget to non-negative",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T10:01:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cc4c554d14b3a4b419a2f6edf1e2d32659548a5a",
"body": "Rebase onto main brought in the table format (#19); update its budget block to\nthe *int BudgetMaxChars type and BudgetUnlimited flag, and add the recommended\nlength row for parity with the TUI.",
"is_bot": false,
"headline": "fix(output): handle *int BudgetMaxChars and unlimited in table renderer",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T10:01:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d5a9ea20164591d429459bc7fa94f6daf2fbef26",
"body": "A small sentinel (999) could in theory equal a genuinely computed budget\nlength, which would then be misreported as unlimited. Use math.MaxInt, which\nthe log-based calculation can never produce.",
"is_bot": false,
"headline": "fix(budget): make unlimited sentinel non-colliding (math.MaxInt)",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T10:01:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d895ab5f00c39384d700e875d49729096afab0e7",
"body": "…ncalculated\n\nA calculated 0 ('cannot resist even a 1-char password') is meaningful and\ndistinct from 'not calculated' (--guesses, or no --budget). With a plain int +\nomitempty the two collapsed, and the TUI wrongly printed '0 (Cannot resist)'\nfor an uncalculated value. Make it *int: nil omits the JSON field and the TUI\nrow; a calculated value (including 0) is shown.",
"is_bot": false,
"headline": "refactor(budget): use *int for BudgetMaxChars to distinguish 0 from u…",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T10:01:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de4c50f902a0ee6eac85dff0a39ad31637430b53",
"body": "MaxLengthForBudget returns 999 as an infinity sentinel for owned hardware\n(no rental cost). That number leaked into the output verbatim: the TUI showed\n\"999 chars (Within budget)\" and JSON emitted budget_max_chars: 999, both read\nas a literal length. Name the sentinel (cost.UnlimitedBudgetChars), surface it\nas a BudgetUnlimited flag, render it as \"∞ (owned hardware — no rental cost)\"\nin the TUI, and omit the bogus length from JSON.",
"is_bot": false,
"headline": "fix(budget): represent owned-hardware budget as unlimited, not 999",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T10:01:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ef0e1cb7a8eb7fd35485d0d53ca60b6469d1c4b6",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-06-24T10:00:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "691203e5e0f7b449e5f1deef6669b3dfa0f01c11",
"body": "Move the unsupported-format check into the up-front guard so it fails fast\nwithout running the full per-profile computation.",
"is_bot": false,
"headline": "refactor(cli): reject sarif with --all-hw before building the matrix",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:58:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e4f59f28707891fa9cd35df46df65373346bf43",
"body": "--all-hw compares every profile, so a single --hw selection is meaningless;\nerror rather than silently ignore it, consistent with the other guards.",
"is_bot": false,
"headline": "fix(cli): reject --hw combined with --all-hw",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:58:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f53cb0f76abe156db8c504bfb2dbbcf85f1b9542",
"body": "Make buildMatrix a pure function of its arguments instead of reading the\npackage-level flag globals, matching how memoryMB is already passed.",
"is_bot": false,
"headline": "refactor(cli): pass algo and workFactor into buildMatrix",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:58:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1d6baa701be2c93aac7e274db337cd237ef236f3",
"body": "…them\n\nSilently dropping --fail-under-time under --all-hw would bypass a CI security\ngate, and emitting a table for -o sarif breaks downstream parsers. Return a\nclear error for --budget, --fail-under-time, and sarif when combined with\n--all-hw. Also route matrix JSON through a testable io.Writer helper.",
"is_bot": false,
"headline": "fix(cli): reject conflicting flags with --all-hw instead of ignoring …",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:58:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e8d6374da0fe6420ac12fa95742f4b949bd49c6",
"body": "Build the matrix body once and write it with a checked io.WriteString instead\nof unchecked fmt.Fprintf calls into the tabwriter.",
"is_bot": false,
"headline": "fix(lint): check write error in matrix renderer (errcheck)",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:58:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae65f70505470e31ffcd7a7d3cda3ae71175e772",
"body": "Runs the password against every profile in one shot and prints a matrix sorted\nfastest-attacker-first (Raspberry Pi to 8x H100), with owned hardware shown as\n\"owned\" instead of a rental cost. Supports -o json for an array. This is the\nclearest way to show how hardware scales the threat. It is a standalone\ncomparison view, so --budget and --fail-under-time (single-profile concepts)\nare not combined with it.",
"is_bot": false,
"headline": "feat(cli): add --all-hw to compare across every hardware profile",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:58:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb6e2c9223e8200eee914f8282479e10f13db099",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-06-24T09:49:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7be213c9614af9d5905a3379e19b03589f54e478",
"body": "When installed via 'go install .../brtc@vX', ldflags are not applied, so the\nversion stayed 'dev'. getVersion() reads the module version from build info as\na fallback so installed binaries report their tag.",
"is_bot": false,
"headline": "feat(cli): fall back to build-info version for go install",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:48:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "93e5dc126c58187555fd2537447236b28977a3f1",
"body": "nil makes cobra fall back to os.Args (the go test flags) on a later Execute.",
"is_bot": false,
"headline": "test(cli): use empty args slice in --version test cleanup",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:48:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc984a8ba6dfba071f1cfe81f926769a2b5880b2",
"body": null,
"is_bot": false,
"headline": "test(cli): reset command output writer in --version test cleanup",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:48:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c50b3f0c3cf1aef8f1726c8aee546aaaa3b3b89d",
"body": "The release pipeline ships tagged binaries via goreleaser, but the binary had\nno way to report its own version. Wire cobra's Version field to a package var\ndefaulting to \"dev\" and inject the real value at release time via -ldflags.",
"is_bot": false,
"headline": "feat(cli): add --version flag",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:48:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bdfb57519c8128729728f4a78c5977cb69d961b7",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-06-24T09:46:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f34a914e56b046f63dd7bb69c3be5f130fadb7d2",
"body": null,
"is_bot": false,
"headline": "fix(cli): include table in unknown-format error message",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c375d10cce972c3da7839979a1992b54716f64cb",
"body": "…o TUI\n\nA misspelled -o value (e.g. 'jsn') silently rendered the TUI, which is\nconfusing in scripts and CI. Reject unrecognized formats with a clear error.",
"is_bot": false,
"headline": "fix(cli): error on an unknown output format instead of falling back t…",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "52741cc2d82feafae42c7c6a5256ec6882c4339e",
"body": "isatty.IsTerminal reports false for MSYS/Git Bash terminals on Windows;\nalso check IsCygwinTerminal so the interactive TUI is not downgraded to JSON\nin those shells.",
"is_bot": false,
"headline": "fix(cli): detect Cygwin/MSYS terminals for TTY check",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e6c522cdb302fc344d6960ee7d6ab461144f874",
"body": "The default output format is the TUI. When stdout was piped or redirected,\nbrtc still ran the Bubble Tea program, emitting escape codes into the pipe (or\nfailing outright in CI). Detect a non-terminal stdout and, unless the user set\n-o explicitly, downgrade the default tui to json so 'brtc pw | jq' just works.",
"is_bot": false,
"headline": "fix(cli): fall back to JSON output when stdout is not a terminal",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "177f62b537a5f828cab4913178974b1ee8727c17",
"body": "Absent combinations now leaves the field untouched (stdlib merge semantics)\nwhile an explicit null clears it; the quoted string form is decoded with\nstrconv.Unquote instead of a naive Trim.",
"is_bot": false,
"headline": "fix(json): distinguish absent from null and unquote robustly",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f2bbe132b028694a7132fcb1612720dad5068929",
"body": "UnmarshalJSON returned early on null without resetting the field, so decoding\na null over a struct that already held a value left it stale. Set it to nil.",
"is_bot": false,
"headline": "fix(json): clear combinations when payload is null",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e94f88a3c6b4299a1702394acfe3c9710277c80",
"body": "Address review: marshal a nil Combinations as JSON null instead of \"0\", and\nmake UnmarshalJSON accept both the new string form and the legacy bare-number\nform (plus null) via json.RawMessage, so old payloads still decode.",
"is_bot": false,
"headline": "fix(json): preserve null combinations and accept legacy number form",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f1658ee75af27c055c31065ca4edbd74c5544de",
"body": "R^L is emitted as the JSON 'combinations' field. As a bare JSON number it\noverflows IEEE-754 doubles (even a 9-char password exceeds 2^53, and long\npasswords produce hundred-digit values), so JavaScript and many other parsers\nsilently truncate it. Marshal it as a string, with a matching UnmarshalJSON so\nthe format still round-trips.",
"is_bot": false,
"headline": "fix(json): emit combinations as a string to preserve precision",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ae292231d59755a42079ee1b6c5fd9f7fb46b31",
"body": "…solve\n\nlookupProfile lowercased but did not trim, while ResolveProfileName trimmed;\nextract normalizeProfileKey so both agree (whitespace + case) and a padded\n--hw value resolves consistently.",
"is_bot": false,
"headline": "refactor(cost): share profile-key normalization between lookup and re…",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "76c3a6b788d87f9a9f9a161d763e6d30f241e1a6",
"body": "Use cobra's error writer instead of os.Stderr directly so the warning honours\nany custom writer set on the command (e.g. in tests or when embedded).",
"is_bot": false,
"headline": "refactor(cli): emit unknown-hw warning via cmd.PrintErrf",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "26e6b81330fc6ebf5ad335b6715087d409441883",
"body": "An unknown --hw value silently falls back to rtx-4090, but the results\nstill echoed the bogus input as the hardware profile, so the numbers\ndescribed a different (much faster) GPU than the label claimed. Resolve the\nprofile name up front, print a stderr warning when it falls back, and emit\nthe canonical profile name in the output.",
"is_bot": false,
"headline": "fix(cli): warn and report resolved profile on unknown --hw",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0c2a358a977c35c814ae9e6625764203ff148bbd",
"body": null,
"is_bot": false,
"headline": "test(cli): reset flag-bound budget global between tests",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c4031e69c1553cb2a2cc7085861c8144ca35a969",
"body": "Reset SilenceUsage (mutated by RunE) and use an empty args slice instead of\nnil, which would otherwise make cobra fall back to os.Args (the go test flags)\non a later Execute.",
"is_bot": false,
"headline": "test(cli): fully reset shared rootCmd state in cleanup",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "99ca30379f6b0bb2949be86f15d51251c738c109",
"body": "…errors\n\nMove SilenceUsage into RunE so genuine argument-parsing errors (unknown flag,\ntoo many args) still show the usage block, while runtime failures from RunE do\nnot. Reset the command's writers in the test cleanup to avoid cross-test state.",
"is_bot": false,
"headline": "refactor(cli): keep usage for arg-parse errors, silence only runtime …",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ef9023f3df6918c577f09a647b892619d882ee9a",
"body": "…lures\n\nRuntime errors from RunE (e.g. an invalid --budget) previously printed the\nfull flag usage block and the error string twice: once by cobra and once by\nmain(). Set SilenceUsage/SilenceErrors so main() prints the error a single\ntime and usage is reserved for actual argument-parsing help.",
"is_bot": false,
"headline": "fix(cli): silence cobra usage dump and duplicate error on runtime fai…",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-24T09:44:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b8ab78ff7ff629c5c0fc2d17ba3c4ee25c33a52",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-06-23T14:54:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b31a1f9017926f6ada094b3bcb042e8595d3139e",
"body": "The recommend-length test (#21) referenced model.loaded, but the field was\nremoved when the TUI dropped Bubble Tea (#16). Both merged, leaving main\nuncompilable. Use initialModel(data).View() to match the current model.",
"is_bot": false,
"headline": "fix(ui): repair broken test after Bubble Tea removal",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-23T14:53:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "699954cf58871251922b5768a1066cef5d0c4e26",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-06-23T14:13:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c13ee1225ffe08f1783943c75363943dc5ca3587",
"body": "An extreme --fail-under-time threshold can overflow the intermediate product\nto +Inf, making the computed length Inf/NaN; converting that to int yields a\nnegative value that wrongly surfaced as a 1-char recommendation. Cap the result\nat a sentinel (999) so an impossible requirement never recommends a trivially\nshort password.",
"is_bot": false,
"headline": "fix(cost): clamp MinLengthForTime on float overflow",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-23T14:11:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "233c83d034136758e5123afa960fd4b8f01db69f",
"body": "A --fail-under-time gate tells you a password failed but not what to do about\nit. Invert the time formula (cost.MinLengthForTime) to report the minimum\nlength over the same charset that would survive the threshold on the chosen\nhardware. Surfaced as 'Recommended Len' in the TUI (green once the current\npassword already meets it) and 'recommended_chars' in JSON. The threshold is\nnow parsed once, before output, and reused by the gatekeeper.",
"is_bot": false,
"headline": "feat(cli): recommend the minimum safe length for --fail-under-time",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-23T14:11:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "284df5cb6b18565b116d801d2b477feb85154133",
"body": "Avoid a nil pointer dereference if PrintTable is called with a zero-value\nOutputData; fall back to \"0\" like the other renderers.",
"is_bot": false,
"headline": "fix(output): guard against nil Combinations in table renderer",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-23T14:11:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "398d04367721ec45207a8023a6c6629169d55275",
"body": "Build the table body once and write it with a checked io.WriteString instead\nof unchecked fmt.Fprintf calls into the tabwriter.",
"is_bot": false,
"headline": "fix(lint): check write error in table renderer (errcheck)",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-23T14:11:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e3d38df618446436e76b787fc327d3ceb3f2b2a",
"body": "Adds a colour-free, ANSI-free aligned table format alongside tui/json/sarif.\nUseful for piping, pasting into docs, or terminals where the TUI is noise but\nJSON is overkill. Reuses FormatDuration and is rendered through an io.Writer\nso it can be unit-tested without capturing stdout.",
"is_bot": false,
"headline": "feat(output): add -o table plain-text output",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-23T14:11:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "702d134ff4e798b10a385bc8a9c9d63979cd44ab",
"body": "…atives\n\nReplace the manual string slicing in formatCombinations with big.Float and\n%.3e: it rounds instead of truncating and handles negative inputs, per review.",
"is_bot": false,
"headline": "refactor(tui): format combinations via big.Float for rounding and neg…",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-23T14:10:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d528687617f5a9cc4e2827458546e8a248b9d292",
"body": "R^L for a long password is hundreds of digits; printed verbatim it blew the\nbounded TUI box apart. Render combination counts exactly up to 21 digits and\nfall back to scientific notation (e.g. the ~395-digit 94^200 becomes\n4.222e394) beyond that.",
"is_bot": false,
"headline": "fix(tui): show huge combination counts in scientific notation",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-23T14:10:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3124fc732de809b1dadd4c00286d49239547c8d9",
"body": "The view is fully determined before render and the program quit immediately\nafter the first frame, so the Bubble Tea event loop was dead weight (and its\nUpdate key handling was unreachable). Print the Lipgloss render straight to\nstdout: simpler, no terminal required (so piped -o tui no longer errors), and\ndrops the bubbletea dependency.",
"is_bot": false,
"headline": "refactor(tui): print the result directly instead of via Bubble Tea",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-23T14:10:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d5b9b1aa6cfe420c42fe15c797c1b56ac42cf04c",
"body": "The TUI batched a spinner with a hard-coded 500ms time.Sleep 'for effect'\nbefore revealing results that were already fully computed before the program\neven started. That is latency the user pays on every run for a fake animation.\nRender the result immediately and quit; this also removes the now-unused\nspinner and the bubbles dependency.",
"is_bot": false,
"headline": "fix(tui): drop the artificial 500ms loading delay",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-06-23T14:10:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ef5bd49cc432c50cd732d49efd760ddef056603c",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-06-22T10:16:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "baca370c37aa5f0936689457d8d4a9fa77ff1953",
"body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v6...v7)\n\n---\nupdated-dependenc\n[…]\n:\n- dependency-name: actions/checkout\n dependency-version: '7'\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump actions/checkout from 6 to 7",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-22T10:15:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fb0b23f91791d3938fa867150752ca795389683d",
"body": "- Cross-compile darwin/linux × amd64/arm64\n- Publish Homebrew cask to kanywst/homebrew-tap on tag\n- Generate CycloneDX SBOMs with syft per archive\n- Sign checksums with cosign (keyless, Sigstore via GitHub OIDC)\n\nReleasing requires HOMEBREW_TAP_GITHUB_TOKEN secret (PAT with contents:write\non kanywst/homebrew-tap).",
"is_bot": false,
"headline": "feat(release): add goreleaser config and release workflow",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-27T14:12:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d1c0fe725fb95e84ce5711a0cfc5105b23b1462a",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-05-11T03:12:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "beb716e6f95f4124358433c5cc14171f2a9d344d",
"body": "Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7.\n- [Release notes](https://github.com/actions/upload-artifact/releases)\n- [Commits](https://github.com/actions/upload-artifact/compare/v4...v7)\n\n---\nupdated-dependencies:\n- dependency-name: actions/upload-artifact\n dependency-version: '7'\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump actions/upload-artifact from 4 to 7",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-11T03:10:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cfbffa357c9372844f70b959ae29be5ff834c5ad",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-05-05T07:20:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "624d0042d26c38c2448b9de0ea5dc9075ec6bbc2",
"body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5 to 6.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-go\n dependency-version: '6'\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump actions/setup-go from 5 to 6",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-05T07:18:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0858908f1db8ce9430ab4ad204d3498b77a0795a",
"body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v4...v6)\n\n---\nupdated-dependenc\n[…]\n:\n- dependency-name: actions/checkout\n dependency-version: '6'\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump actions/checkout from 4 to 6",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-05T07:18:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "65cb2778eb000427ad90845bed8d75585bca4d7d",
"body": "Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 7 to 9.\n- [Release notes](https://github.com/golangci/golangci-lint-action/releases)\n- [Commits](https://github.com/golangci/golangci-lint-action/compare/v7...v9)\n\n---\nupdated-dependencies:\n- dependency-name: golangci/golangci-lint-action\n dependency-version: '9'\n dependency-type: direct:production\n update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci(deps): bump golangci/golangci-lint-action from 7 to 9",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-05T07:18:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0344ad4f14ade75061a528998a01a45f4adebf96",
"body": null,
"is_bot": true,
"headline": "chore(demo): regenerate VHS gif [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-05-05T07:13:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae226f0635384b5cff6d30228accdb894dfe3bdd",
"body": "big.ParseFloat happily accepts 'inf' / '+inf' / '-inf'. The\nsubsequent big.Float.Int(nil) on +Inf returns a nil *big.Int rather\nthan an error, and that nil value would then panic downstream in\nTimeToCrack via big.Float.SetInt(nil).\n\nAdds an explicit IsInf check after sign validation, plus tests for\n'inf' and '+inf'.",
"is_bot": false,
"headline": "fix(calc): reject infinite ParseGuesses input",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:12:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7075a376f68d52bf909ec48c36080f4c9bd2df47",
"body": "Adds the two new flags to the options table, plus a worked example\nof the recommended brtc + zxcvbn combo (zxcvbn does pattern detection,\nbrtc converts the resulting guess count into time and USD), and an\nArgon2id memory-sweep example showing how memory hardens against GPU\nattackers.",
"is_bot": false,
"headline": "docs(readme): document --memory, --guesses, and zxcvbn pairing",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:12:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c54cb83a4eca2b3bf2afa09d95f53045ccac8c59",
"body": "--memory accepts an Argon2id memory parameter (e.g. 64m, 128m, 1g)\nthat flows through CalculateHashRate and MaxLengthForBudget so\ndefenders running heavier memory settings see the corresponding cost\nbenefit.\n\n--guesses accepts an external guess count, typically the 'guesses'\nfield from a zxcvbn repo\n[…]\nand a log2 helper\nthat falls back to bit length so log2(huge *big.Int) does not blow\nup float64. MemoryMB is exposed on OutputData JSON via 'memory_mb'\n(omitempty) so JSON consumers see the parameter.",
"is_bot": false,
"headline": "feat(cli): add --memory and --guesses flags",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:12:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "64b9b4b0fda05d1ff213f1c9885514a6417dc900",
"body": "Argon2id is a memory-hard function: its actual attacker throughput\ndepends almost as much on memory pressure as on time iterations. The\nprevious CalculateHashRate formula divided only by workFactor (t),\ntreating memory as a fixed baseline. That underestimated defender\nstrength for any policy that bu\n[…]\nears to\nspeed the attacker up.\n\nThis commit is just the signature/scaling change. All call sites pass\n0 (= use baseline), preserving the prior behavior. The next commit\nwires up the --memory CLI flag.",
"is_bot": false,
"headline": "feat(cost): accept argon2id memory parameter in hashrate scaling",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:12:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9b0a8a62a1df2d8d0b135e5b52d8795744c5f0d5",
"body": "ParseMemory accepts the Argon2id memory parameter as 64m, 1g, or a\nbare integer (MB). KB intentionally omitted because Argon2id is\nnever configured below MB granularity.\n\nParseGuesses accepts the 'guesses' field from a zxcvbn report,\nincluding scientific notation (1.234e+10). Returns *big.Int because\nguess counts for long passwords routinely exceed int64.\n\nBoth helpers are wired up in the next commit.",
"is_bot": false,
"headline": "feat(calc): add ParseMemory and ParseGuesses helpers",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:12:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "80c0b57e82a0ba3a211da2ead2bb6898698cc590",
"body": "VHS drives headless Chrome internally; on ubuntu-latest with the\ndefault Docker shm size (64MB), Chrome crashes with\n'chrome_crashpad_handler: --database is required' before any frame\nis captured. Sharing the host IPC namespace gives the container\nenough shared memory to render. Drops --user because the image's\nttyd/chrome bits expect the in-image user; ownership of the produced\ngif is fixed up via sudo chown after the run.",
"is_bot": false,
"headline": "ci(vhs): pass --ipc=host so Chrome inside the VHS image has enough shm",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:11:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "13da45d13d354b57d43b64170fbab3a59674c6a1",
"body": "charmbracelet/vhs-action@v2 fails to install ffmpeg on the current\nubuntu-latest runner image (see the failed run on PR #5). The\nofficial ghcr.io/charmbracelet/vhs Docker image bundles ttyd,\nffmpeg, and fonts so the render step does not depend on apt or any\nnetwork install at action time.",
"is_bot": false,
"headline": "ci(vhs): switch to Docker image instead of vhs-action",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:11:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "81961c7609519e74f0b255e72414d3ff72b1c2c5",
"body": "PR runs upload the rendered gif as an artifact (preview) without\nwrite permissions, so forked PRs don't try to push.\n\nPushes to main render the gif and auto-commit only if it actually\nchanged, with [skip ci] in the message to avoid loops. Triggered by\nchanges to demo.tape, Go sources, or the workflow itself.",
"is_bot": false,
"headline": "ci: add VHS workflow to render demo.gif on PR and main",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:11:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c6ef21c83eeb8d5b8bacbf79d7429733eaf76560",
"body": "The previous demo.tape ran 'go build -o brtc' from inside VHS, which\nrequired a Go toolchain to be present in the VHS container — not the\ncase for charmbracelet/vhs-action. Caller (CI workflow or local user)\nnow builds the binary first; the tape only adjusts PATH.\n\nRegenerates assets/demo.gif from the new tape so the first CI run\nfinds it unchanged and skips the auto-commit.",
"is_bot": false,
"headline": "chore(demo): drop in-tape go build and regenerate gif",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:11:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "47ae3c8e03cbdfb44b5ef96dd09c4602797ca6ff",
"body": "Adds a callout immediately under the title pointing readers at zxcvbn\nfor pattern detection. Raw entropy makes 'P@ssw0rd!' look strong, but\na real attacker with a dictionary cracks it in seconds. Setting the\nexpectation up front avoids misuse and prepares the ground for the\nupcoming --guesses flag that lets brtc consume zxcvbn output.",
"is_bot": false,
"headline": "docs: clarify brtc is a cost calculator, not a strength meter",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:11:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f7e4fd7ed56ba7be043f566279b1d85e34cb2cd",
"body": "Previously, when CalculateHashRate received an algorithm not present\nin the profile's Hashrates map, it picked up the raw bcrypt baseline\nbut then dropped into the default switch arm and returned that\nbaseline unchanged. With --cost 12, the attacker rate would be\nshown as the cost=5 baseline (32x to\n[…]\nt' before the switch so the\ncost-factor scaling applies. Also tightens the init() check to\nrequire a positive bcrypt hashrate on the fallback profile so the\nfallback path can never silently produce 0.",
"is_bot": false,
"headline": "fix(cost): apply bcrypt scaling when falling back from unknown algo",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:01:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "29be346ab74a262fba367755243239b7d3b87262",
"body": "TestProfilesAreComplete walks every entry in the embedded YAML and\nfails CI if any profile is missing a display name, source URL/note,\nlast_reviewed date, or a positive hashrate for any of the algorithms\nthe CLI exposes via --algo. Catches half-filled YAML rows the next\ntime someone adds a profile or an algorithm.",
"is_bot": false,
"headline": "test(cost): require hashrate completeness and citation per profile",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:01:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "12f987edeae75ff6151fccc0728d138b8c171b4d",
"body": "Hardware hashrate baselines used to live as hardcoded literals in a Go\nmap, which made two things hard:\n\n 1. Every refresh required a Go code change and a code review of the\n numbers themselves, mixing data ownership and code ownership.\n 2. There was no place to record where each number came f\n[…]\nevery profile struct.\n\nCalculateHashRate / TotalCost are unchanged behaviorally; the unknown-\nprofile fallback is now a constant (fallbackProfile) instead of magic\n\"rtx-4090\" strings sprinkled around.",
"is_bot": false,
"headline": "refactor(cost): externalize hashrates to embedded YAML with citations",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T07:01:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b68850682ab1ecd989b6310dabf7abc2caa8bd28",
"body": "Disable revive's exported and package-comments rules — they require\ngodoc-style WHAT comments on every exported symbol, which conflicts\nwith the repo policy of comments only when the WHY is non-obvious.\nOther revive checks stay on.\n\nAlso rewrites the !(large > small) assertion in cloud_test.go to\nthe equivalent large <= small per staticcheck QF1001.",
"is_bot": false,
"headline": "chore(lint): silence revive WHAT-only comment rules and fix de-Morgan",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T06:32:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9c96b9edb14bc100cae8f27efb691dae9a3b5067",
"body": "Adds unit tests for the previously untested cost and ui packages:\n- bcrypt 2^(workFactor-5) scaling and the cost<5 clamp\n- argon2id linear scaling\n- ParseBudget tolerance for usd/$ suffixes and surrounding whitespace\n- MaxLengthForBudget owned-hardware sentinel and budget monotonicity\n- OutputData J\n[…]\nield\n- FormatDuration unit transitions\n\nAlso adds a guardrail test (TestProfilesContainAdvertisedNames) so any\nfuture drift between the --hw flag/README list and the Profiles map\nis caught at CI time.",
"is_bot": false,
"headline": "test: cover cost and ui helpers",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T06:32:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fa218a7b77a5357894a0fb1ca7e881de0002fad6",
"body": "The fail-under-time parser was inline in cmd/root.go with no test\ncoverage. Pulling it into internal/calc/duration.go gives it a\nproper unit test for unit boundaries, trimming, case sensitivity,\nand rejected composite forms like 1h30m.",
"is_bot": false,
"headline": "refactor: move duration parser into calc package and add tests",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T06:32:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0331d825b7ee08852f5d15a236299150130bc8b7",
"body": "os.Exit(1) inside RunTUI bypassed the cobra RunE return path, so the\n--fail-under-time gatekeeper logic and any caller-side cleanup never\nran. Wrapping the underlying error with %w lets callers Unwrap if\nthey want to distinguish render failures.",
"is_bot": false,
"headline": "fix(ui): propagate TUI errors instead of os.Exit",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T06:32:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "644f4aaac9674fdc1e8cb6323c63f9487dd0c991",
"body": "Both profiles were already advertised in the --hw flag help and the\nREADME table but absent from the Profiles map, causing a silent\nfallback to rtx-4090. Hashrates are scaled from the existing mac-m3\nand cpu-standard baselines (M3 Max ~3x base M3 GPU cores, Pi 4 ~1/20\nof an 8-core x86 CPU).",
"is_bot": false,
"headline": "feat(cost): add mac-m3-max and raspberry-pi-4 hardware profiles",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T06:32:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "758f0dcd6fa50c6dbf5371f402da7d1cac799e17",
"body": "Bumps the linter's parsed Go version from 1.24 to 1.25 to match go.mod\nand CI. Adds revive/unconvert/unused to catch low-effort issues, and\nmoves gofmt/goimports under the v2 formatters block so 'golangci-lint\nfmt' can replace ad-hoc 'go fmt' invocations.",
"is_bot": false,
"headline": "chore(lint): align go version with go.mod and enable formatters",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T06:32:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15263eca109fe005401d7118a6f2f2e81654bafc",
"body": "Weekly Monday 09:00 JST. Charm and cobra ecosystems are grouped so\nrelated bumps land in a single PR.",
"is_bot": false,
"headline": "ci: add dependabot for gomod and github-actions",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T06:32:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "06bb4d8c2adc62f0e85f3da9ee4ecf6f1cb1699f",
"body": "Build artifacts, test output, IDE/OS metadata, and local Claude Code\nstate should not be checked in. The compiled brtc binary was 5.2 MB\nand would drift from source on every release.",
"is_bot": false,
"headline": "chore: untrack brtc binary and add .gitignore",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-05-05T06:32:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f08013eb66238b2a9461bdee067fe188a73722e",
"body": null,
"is_bot": false,
"headline": "ci: fix golangci-lint v2 config schema errors",
"author_name": "kanywst",
"author_login": "kanywst",
"committed_at": "2026-03-08T05:53:55Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 4,
"commits_last_year": 106,
"latest_release_at": "2026-07-19T13:28:26Z",
"latest_release_tag": "v1.3.0",
"releases_from_tags": false,
"days_since_last_push": 6,
"active_weeks_last_year": 7,
"days_since_latest_release": 7,
"mean_days_between_releases": 44.4
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/kanywst/brtc",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/kanywst/brtc",
"is_deprecated": false,
"latest_version": "v1.3.0",
"repository_url": "https://github.com/kanywst/brtc",
"versions_count": 4,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-19T13:21:47Z",
"latest_version_yanked": null,
"days_since_latest_publish": 7
}
]
},
"popularity": {
"forks": 0,
"stars": 0,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": {
"days": [],
"complete": true,
"collected": 0,
"total_stars": 0,
"collected_at": null
},
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 12770,
"source_files_sampled": 35,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/charmbracelet/lipgloss",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.1.0"
},
{
"name": "github.com/mattn/go-isatty",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.23"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "github.com/trustelem/zxcvbn",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.1"
},
{
"name": "gopkg.in/yaml.v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.0.1"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 25,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 1
},
"bus_factor": 1,
"bot_contributors": 2,
"top_contributors": [
{
"type": "User",
"login": "kanywst",
"commits": 85,
"avatar_url": "https://avatars.githubusercontent.com/u/45947799?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"release.yml",
"vhs.yml"
],
"has_docs_dir": false,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "6 out of 6 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/9 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 8,
"reason": "1 out of the last 1 releases have a total of 1 signed artifacts.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "245794bbdab261d3d40a9b12d15315fd41bc91b0",
"ran_at": "2026-07-26T22:34:06Z",
"aggregate_score": 5.3,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-20T01:57:29Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-20T01:55:53Z",
"ci_last_conclusion": null,
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/kanywst/brtc",
"host": "github.com",
"name": "brtc",
"owner": "kanywst"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 58,
"inputs": {
"security": 53,
"vitality": 81,
"community": 24,
"governance": 52,
"engineering": 76
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 81,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 69,
"inputs": {
"commits_last_year": 106,
"human_commit_share": 0.79,
"days_since_last_push": 6,
"active_weeks_last_year": 7
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "7/52 weeks with commits",
"points": 4.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 7
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "106 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 106
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 98,
"inputs": {
"releases_count": 4,
"latest_release_tag": "v1.3.0",
"releases_from_tags": false,
"days_since_latest_release": 7,
"mean_days_between_releases": 44.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "4 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 4
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 7 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 7
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~44.4 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 44.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "1 out of the last 1 releases have a total of 1 signed artifacts.",
"points": 8,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 24,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 0,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "0 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 0
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 52,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 69,
"inputs": {
"merged_prs": 25,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 1
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "25/26 decided PRs merged",
"points": 36.8,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 25,
"decided": 26
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/9 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 51,
"inputs": {
"followers": 8,
"owner_type": "User",
"is_verified": null,
"owner_login": "kanywst",
"public_repos": 42,
"account_age_days": 2778
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "8 followers of kanywst",
"points": 6.9,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 8,
"login": "kanywst"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "42 public repos, account ~7 yr old",
"points": 23.9,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 42
}
},
{
"code": "account_age_years",
"params": {
"years": 7
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"packages": [
"github.com/kanywst/brtc"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 7
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 7 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 7
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "4 published versions",
"points": 12,
"status": "partial",
"details": [
{
"code": "published_versions",
"params": {
"count": 4
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 76,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 84,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "3 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 3
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "6 out of 6 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"topics": [
"argon2",
"bcrypt",
"brute-force",
"bubbletea",
"cli",
"cost-calculator",
"devsecops",
"entropy",
"go",
"password-cracking",
"password-strength",
"sarif",
"security",
"tui",
"zxcvbn"
],
"has_wiki": false,
"homepage": "https://pkg.go.dev/github.com/kanywst/brtc",
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://pkg.go.dev/github.com/kanywst/brtc",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "15 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 15
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 53,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 18,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 0,
"scorecard_aggregate": 5.3
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "6 out of 6 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/9 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "1 out of the last 1 releases have a total of 1 signed artifacts.",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 69,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "79 of 79 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 79,
"sampled": 79
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 80,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0.08
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "8 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 8,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 12770,
"source_files_sampled": 35,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/35 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 35,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-26T22:34:19.556424Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/k/kanywst/brtc.svg",
"full_name": "kanywst/brtc",
"license_state": "standard",
"license_spdx": "MIT"
}