About RepoTrust

Know how a repository was built before you trust it.

Choosing a dependency or a tool used to mean checking stars, recent commits and the README. That no longer works. Code can be generated faster than anyone reviews it, popular repositories can be star-farmed, and some exist only to deliver malware. RepoTrust gives you an evidence-backed read on any public repository before you depend on it.

Who it's for

• Developers choosing a library, a CLI or an app: a quick, honest picture of how a project was built and how risky it is to rely on.
• Application security teams vetting open source: separate, documented signals for supply-chain risk, with links to the evidence and a JSON export of every report.
• Maintainers: a badge for your README, and a way to dispute a score that's wrong.

What it measures

Each repository gets three scores. They are never blended into one number, because they answer different questions.

• AI provenance: how much of the code was AI-generated, and how sure we are. Explicit attribution (commit trailers, AI agents' commits) is a hard lower bound. Weaker signals, such as AI tool configuration or LLM-style comments, are labelled as such.
• Code quality: complexity, duplication, lint density, tests and CI, documentation, type safety and review practice.
• Security: secrets in the code and its history, static analysis, known-vulnerable dependencies, CI workflow risks and security posture. Warning flags call out repos that look like malware lures or have suspicious star growth.

We're neutral about AI. Using AI to write code is a fact worth disclosing, not a defect. AI-written code can score well on quality and security, and hand-written code can score badly. What matters is whether the code was reviewed, tested and secured, and that is what the other two scores measure.

How it works

• Static analysis only. A repository is cloned into an isolated container with no network, and analyzed with pinned open-source tools: gitleaks, opengrep, osv-scanner, zizmor, lizard and others. Its code is never installed, built or run.
• Evidence for everything. Every score links to the commits, files and lines behind it, and the full report is published as JSON.
• Calibrated. We measure accuracy against labelled repositories. In the latest calibration (697 repositories):
  • an AI label was right 362 times out of 363;
  • it appeared on 1 of 263 human-written repositories;
  • 83% of AI-built repositories carried a label.
  • The methodology has the details.
• Correctable. If a score is wrong, dispute it. We fix the method for everyone and re-score; we never hand-edit a single score.

What it isn't

• Not a verdict on people. Scores attach to repositories, never to authors.
• Not a guarantee. A strong security score means our tools found few problems, not that none exist. Signals come with stated confidence and coverage.
• Not a malware scanner. Lure flags are warnings based on how a repository presents itself, not proof.

Which repositories are scored

• The most-starred repositories in a dozen languages.
• New repositories gaining traction.
• Anything submitted by visitors.

Popular repositories are re-scored regularly, and submissions usually appear within the hour.

Who's behind it

RepoTrust is built and run by Synaptic Cybersecurity. To get in touch about a score, use the submit form; for anything else, reach us through synapticcyber.com.