What we find across scanned codebases
Why is there no data on this page yet?
Because there is not enough of it. This page publishes nothing until the corpus reaches 100 scanned public repositories, and it currently holds 11. A percentage drawn from a handful of projects, presented as an industry finding, is a claim nobody should believe — including when we make it.
The threshold
89 more public repository scans and the figures below appear here automatically.
What will be published
Once the sample is large enough, this page will report — across public repositories only, in aggregate, with the sample size printed beside every figure:
- · Share with no test directory detected
- · Share with no CI configuration
- · Share containing an exposed secret or committed environment file
- · Security risk-level distribution
- · The most common classes of secret found
- · The same measures broken down by ecosystem
Private repositories are excluded outright, and any bucket holding fewer than 10 scans is suppressed rather than reported — a percentage over a handful of projects is re-identification with extra steps, not a finding.
Add to the corpus
Every public scan counts toward the threshold. Free, no signup, results in under three minutes.