CODERISKTOOLS OPEN SOURCE OBSERVATORY
Popular GitHub projects — reproducible scan-coverage index.
PUBLIC PUBLICATION HUB
Read the latest coverage index and reproduce the source
The WordPress page is the editorial entry point. The immutable report bytes, weekly index and source history live in the public reports repository and are published through its reviewed workflow.
- public artifacts are reviewed through pull requests;
- exact source commits, manifests and checksums remain reproducible;
- raw findings, secrets and private operator evidence are not published.
Repository Reports & Scan Coverage
Reports 1–30: one continuous register of public repositories selected by GitHub popularity. This is not a vulnerability ranking, security score, certification, recommendation, or endorsement.
| Report | Repository | Stars at snapshot | Reviewed commit | Scan status | Critical observations | High observations | Medium observations | Low observations | Total observations |
|---|---|---|---|---|---|---|---|---|---|
| 1 | codecrafters-io/build-your-own-x | 529,747 | aa17439b62f3 | COMPLETE | 0 | 0 | 0 | 0 | 0 |
| 2 | sindresorhus/awesome | 487,278 | 7cb5c8371c0f | COMPLETE | 0 | 0 | 0 | 0 | 0 |
| 3 | freeCodeCamp/freeCodeCamp | 452,285 | 8ae71bd8d832 | PARTIAL | 18 | 220 | 111 | 0 | 349 |
| 4 | public-apis/public-apis | 451,760 | aacdeff11b41 | COMPLETE | 0 | 0 | 6 | 0 | 6 |
| 5 | EbookFoundation/free-programming-books | 392,624 | 281dfc4ac86b | COMPLETE | 3 | 0 | 22 | 0 | 25 |
| 6 | nilbuild/developer-roadmap | 362,058 | 8d1f35105753 | COMPLETE | 12 | 22 | 28 | 0 | 62 |
| 7 | 996icu/996.ICU | 276,450 | f5e35f48d769 | COMPLETE | 0 | 0 | 0 | 2 | 2 |
| 8 | react/react | 246,624 | 862e275a1c15 | COMPLETE | 0 | 15 | 84 | 2 | 101 |
| 9 | torvalds/linux | 240,021 | b95f03f04d47 | COMPLETE | 2 | 1816 | 1109 | 10 | 2937 |
| 10 | ossu/computer-science | 207,022 | 33d44a44e352 | COMPLETE | 0 | 0 | 2 | 0 | 2 |
| 11 | tensorflow/tensorflow | 196,436 | 35fd3492a4cb | COMPLETE | 6 | 1064 | 291 | 0 | 1361 |
| 12 | microsoft/vscode | 187,770 | d28fc4f1fb9f | COMPLETE | 32 | 1457 | 5033 | 18 | 6540 |
| 13 | kubernetes/kubernetes | 123,844 | bc5b2109f5dd | COMPLETE | 135 | 1699 | 868 | 7 | 2709 |
| 14 | nodejs/node | 118,338 | 8cf16b31f61b | COMPLETE | 150 | 8364 | 1416 | 60 | 9990 |
| 15 | pallets/flask | 71,988 | 36e4a824f340 | COMPLETE | 8 | 7 | 12 | 0 | 27 |
| 16 | moby/moby | 71,966 | 6719bc3c8d67 | PARTIAL | — | — | — | — | — |
| 17 | chrislgarry/Apollo-11 | 71,803 | 911e5c0283c6 | COMPLETE | — | — | — | — | — |
| 18 | NationalSecurityAgency/ghidra | 71,799 | 264130231b13 | PARTIAL | — | — | — | — | — |
| 19 | juliangarnier/anime | 71,747 | 2c9cf8ea0032 | NOT STARTED | — | — | — | — | — |
| 20 | protocolbuffers/protobuf | 71,682 | 0e436a47e854 | NOT STARTED | — | — | — | — | — |
| 21 | ComposioHQ/awesome-claude-skills | 71,671 | be2a406907db | NOT STARTED | — | — | — | — | — |
| 22 | OpenBB-finance/OpenBB | 71,339 | 3e071fcc2cd9 | NOT STARTED | — | — | — | — | — |
| 23 | nektos/act | 71,310 | 4f411281417e | NOT STARTED | — | — | — | — | — |
| 24 | binary-husky/gpt_academic | 71,179 | d6bde0fa5437 | NOT STARTED | — | — | — | — | — |
| 25 | toeverything/AFFiNE | 71,125 | fdfb6df82605 | NOT STARTED | — | — | — | — | — |
| 26 | microsoft/ai-agents-for-beginners | 71,100 | 15ad10ca6057 | NOT STARTED | — | — | — | — | — |
| 27 | Leonxlnx/taste-skill | 70,923 | e988add20dab | NOT STARTED | — | — | — | — | — |
| 28 | datawhalechina/hello-agents | 70,426 | f8227af2efc4 | NOT STARTED | — | — | — | — | — |
| 29 | swiftlang/swift | 70,212 | 4ef9a5286c51 | NOT STARTED | — | — | — | — | — |
| 30 | ansible/ansible | 70,201 | 2d8c74aa7ae5 | NOT STARTED | — | — | — | — | — |
Page 1 contains reports 1–30. A report page is limited to 50 rows; reports 51 and later will continue on the next page. An em dash means that aggregate counts have not been published in the immutable report yet; it never means zero.
Severity counts are scanner-rule observations in the tested scope, not confirmed vulnerabilities. Raw findings, secret values, paths, snippets, scores, and security conclusions are not published. Open the immutable coverage report JSON.
Scanner and scan scope
Primary scanner: CodeRiskTools Scanner 3.1.3 from 9batalion/coderisktools-scanner, pinned to exact source commit c1698b297e6200313276c8c2ef8e00a40ee9aa42.
Supporting tools: Git for exact-SHA checkout and provenance; Python for bounded orchestration, sharding, aggregation, deduplication checks, and checksums. Trivy, Gitleaks, OSV-Scanner, and other scanner engines were not used. Target repository code was never executed; repositories were treated as data.
Reports 16–30 continue the same register after reports 1–15. Each repository begins with default-branch, exact-SHA, license, and checkout-completeness readback. A status of NOT STARTED is not a clean result.
What the public index includes
- project name and official GitHub repository link;
- review week, SPDX license and CodeRiskTools engine versions;
- completion status and clearly stated review limitations;
- redacted posture signals, exact target commits and bounded scan status.
What is not published
Raw findings, source snippets, paths, rule matches, credentials, exploit instructions and uncoordinated vulnerability details are not published. Newly discovered critical issues are attributed only after confirmation and coordinated disclosure.
A review-required flag is an evidence signal, not a personal accusation or confirmed vulnerability. Secrets and exploit material are never published.