Open secret-scanning alerts. Each row shows a repository's count of detected, unresolved secrets. All three of GitHub's pattern categories are covered: its default provider patterns, the 10 generic patterns (private keys, database connection strings, HTTP authentication headers) and the 1 AI-detected pattern (passwords). The alerts API omits the latter two unless they are requested by name. reference ↗
Open Dependabot alerts for vulnerable dependencies, counted by severity per repository. reference ↗
Repositories with Dependabot security alerts disabled. Enable them so vulnerable dependencies surface as alerts. reference ↗
Repositories with Dependabot security updates disabled. Enable them so fixes for vulnerable dependencies arrive as pull requests automatically. reference ↗
Repositories whose Dependabot configuration omits an update cooldown. A cooldown is mandatory; any cooldown value passes. Repositories with no Dependabot configuration do not appear here. reference ↗
CodeQL code-scanning findings, ranked worst-first by severity. Each row shows a repository's open-alert counts. reference ↗
A configuration is stale once its last scan trails the default branch's newest commit by more than 30 day(s). CodeQL configurations on the default branch whose last scan trails the branch's newest commit by more than the configured threshold -- the condition GitHub's tool status page reports as 'Code Scanning results may be out of date'. Its alerts describe code that has since changed, so a stale configuration can hold a Results/Findings row 'Clean' while nothing is being scanned. Setup is Default (GitHub-managed) or Advanced (a workflow in the repository), and Cause says why the configuration stopped. Last scan is the newest successful upload: a configuration whose runs keep failing ages from its last success, and its cause says so. Orphaned means the setup that produced it no longer exists, so it will never scan again: once the live setup covers its language (see Language Coverage), delete it from the repository's code-scanning tool status page. Superseded means default setup is on, which blocks advanced CodeQL uploads. reference ↗
Repositories where GitHub detects a CodeQL-supported language that no current configuration scans -- typically an advanced workflow whose language matrix omits one the repository contains, such as 'actions' for its own workflow files. Repositories with no CodeQL at all appear in the Results/Findings not-enabled list instead. On default setup GitHub reports only the languages it is set to scan, so a detected language deliberately left out of default setup is not visible here. reference ↗
Repositories whose latest or last-published release is mutable. Republish them as immutable releases so a published artifact cannot change after the fact. reference ↗
aislop AI-slop / code-quality findings, ranked worst-first by severity. reference ↗
Zizmor static analysis of GitHub Actions workflows, ranked worst-first by severity. reference ↗
| Repository | Last release | Last tag |
|---|---|---|
| json-key-value-lookup-action | 61 days ago | 62 days ago |
| semantic-tag-increment | 61 days ago | 62 days ago |
| docker-save-images-action | 61 days ago | 61 days ago |
| release-assets-action | 61 days ago | 61 days ago |
Repositories created within 21 day(s) are excluded. A repository whose newest release or tag is older than 60 day(s) (or has neither) is shown. Repositories ranked by combined release and tag staleness (oldest first). A repository with neither a release nor a tag ranks highest. reference ↗
Repositories with private vulnerability reporting disabled. Enable it so security researchers can privately report vulnerabilities instead of disclosing them publicly. reference ↗
Repositories with the 'Allow auto-merge' setting switched off, so a pull request cannot be queued to merge itself once its requirements are met. The setting only offers the option: an auto-merging pull request still waits for the required checks, reviews and branch protections the repository already enforces, so enabling it relaxes nothing. What it removes is the interval between a change becoming mergeable and somebody noticing -- the window a reviewed dependency update sits in while the vulnerability it fixes stays unpatched. reference ↗
OpenSSF Scorecard supply-chain health scores (a lower score is weaker). Ranked by the worst severity rung present in the table (most findings at that rung first), then weakest score first. Total counts findings only; the score is a health rating, not a finding count, so it is not part of that sum. reference ↗
| Repository | Bug | Feature | Docs | Other | Untriaged | Total | Ext | Oldest |
|---|---|---|---|---|---|---|---|---|
| lftools-uv | 24 | 0 | 0 | 1 | 0 | 47 | 0 + | 4 days + |
| docker-workflows | 2 | 18 | 0 | 5 | 0 | 28 | 0 + | 61 days + |
| .github | 1 | 6 | 0 | 7 | 0 | 14 | 0 | 81 days |
| node-workflows | 3 | 10 | 0 | 1 | 0 | 14 | 0 | 59 days |
| generic-workflows | 0 | 5 | 0 | 0 | 0 | 5 | 0 | 77 days |
| github-code-monkey-bot | 3 | 1 | 0 | 0 | 0 | 4 | 0 | 5 days |
| github-security-report-action | 1 | 1 | 0 | 1 | 0 | 3 | 0 | 4 days |
| info-yaml-validate-action | 0 | 3 | 0 | 0 | 0 | 3 | 0 | 3 days |
| java-workflows | 0 | 2 | 1 | 0 | 0 | 3 | 0 | 10 days |
| node-build-action | 1 | 2 | 0 | 0 | 0 | 3 | 0 | 10 days |
| rust-workflows | 0 | 3 | 0 | 0 | 0 | 3 | 0 | 11 days |
| sigul-sign-action | 2 | 1 | 0 | 0 | 0 | 3 | 0 | 13 days |
| dependency-change-action | 0 | 2 | 0 | 0 | 0 | 2 | 0 | 4 days |
| build-metadata-action | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 10 days |
| docker-build-matrix-action | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 10 days |
| gerrit-clone-action | 0 | 1 | 0 | 0 | 0 | 1 | 0 | today |
| gha-workflow-linter | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 1 day |
| github2gerrit-action | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 2 days |
| grype-scan-action | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 48 days |
| nexus-docker-login-action | 0 | 0 | 1 | 0 | 0 | 1 | 0 | 10 days |
| sbom-action | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 20 days |
| security-workflows | 0 | 1 | 0 | 0 | 0 | 1 | 0 | 11 days |
| Total | 37 | 62 | 2 | 15 | 0 | 141 | 0 |
Open issues per repository, split by label into the configured classes. Issues carrying none of the configured labels count as Other; issues with no labels at all count as Untriaged, which is the column to watch -- an unlabelled issue has not been triaged. Ext counts issues raised from outside the organisation, computed from the collected window rather than the whole backlog. Ranked by total open issues, then by Untriaged. A trailing '+' marks a repository whose window-scoped columns are partial -- its open issues exceed the collected window, or an issue carries more labels than were fetched -- so the label classes and Ext each describe only the issues collected, and Ext in particular can undercount. Total stays exact either way, as does Oldest wherever an age is shown. Organisation membership could not be read for this run, so an author can only be placed outside the organisation when GitHub says so unambiguously; Ext therefore undercounts and should be read as a lower bound. reference ↗
Open pull requests per repository, split by who raised them and what is holding them up. Human and Auto partition the total by author: Auto counts recognised automation (Dependabot, pre-commit.ci, Renovate and the like), Human counts everyone else. Ext counts the human pull requests raised from outside the organisation, so it is a subset of Human and never counts a bot. Conflict counts pull requests blocked on a merge conflict; Fail counts those whose latest checks did not pass, which includes optional checks and so is not by itself proof that a merge is blocked; Review counts those a reviewer has asked for changes on, which is a person waiting on the author; Copilot counts those still carrying an unresolved review thread opened by GitHub's automated code reviewer; Draft counts those still marked as drafts. Those five are independent of the author split and of each other, so one pull request can appear in more than one of them. Ranked by total open pull requests, then by those failing, conflicting or awaiting review, counted once each. Beneath the totals, Unassigned counts the pull requests nobody has picked up; the rest are on somebody's plate. A terminal run that authenticated as a personal account splits that remainder again, into the reader's own queue and everyone else's. A published report leaves that split out, since its readers are not the account it ran as. Organisation membership could not be read for this run, so an author can only be placed outside the organisation when GitHub says so unambiguously; Ext therefore undercounts and should be read as a lower bound. Whether Copilot is still waiting on a reply could not be settled for at least one pull request, whose review threads were unreadable, outnumbered the window this run collected, or came back without a usable count to show that window had covered them. Such a pull request is left uncounted rather than assumed answered, so Copilot undercounts and should be read as a lower bound. reference ↗