Method

A “verified” number is only worth something if we show how we verify.

What we count

An active day is a calendar day (UTC) with at least one human commit on the repo's default branch. Ten commits on the same day count as one day. One commit at 23:59 and another at 00:01 count as two. It is the only number that ranks.

• Commits: the total of human commits read.
• Best streak: the longest run of consecutive weeks (Monday to Sunday) with at least one active day.
• Lifetime: the months between the first and the last commit.
• Authors: the distinct people found in the history, bots excluded. And the maker's share: the commits signed by their GitHub account. When it drops under 80%, the card says so. A card can have up to two co-makers, added by GitHub login and visible once they have signed in: their commits count in that share.
• GitHub stars: shown, never used to rank. They tell who has not been noticed yet.

What we exclude

• Bots: dependabot, renovate, github-actions, semantic-release, snyk, imgbot, copilot and any account GitHub flags as “Bot”. Their commits make neither a day nor an author.
• Other branches: only the default branch is read. Work on a branch never merged does not show.
• Content: never a line of code, never a commit message. Only dates and author names.

The business model excludes nobody. Free, one-time purchase, subscription, freemium: the card shows it for information, the ranking ignores it.

How we know an app has made nothing

We don't know. We ask. Revenue can't be read in a repo. To publish, the maker ticks a box: “These apps haven't made any money yet. I declare it on my honour.” Not a single euro from sales, subscriptions or donations. A paid app that hasn't sold anything yet belongs here, just like a free one.

• The card keeps them apart: “work: verified in the repo”, “revenue: declared by the maker”. The word “verified” belongs to the work. We never write “$0 verified”.
• A card we created from a public repo, not claimed yet, says “revenue: not declared” and has no “$0 earned” stamp. It stays listed: its work is read.
• A maker can lie. As with commits, they then lie in front of everyone, under their own name. If you know a listed app makes money, open an issue.
• Later, maybe: proof read from Stripe, RevenueCat or App Store Connect. That day, the card will say where the number comes from. Until then it is a declaration, and it is written as one.

The first euro

The day the app makes its first euro, the maker declares it, with the date. The app doesn't leave, it crosses a line: it moves from the “Not a cent yet” board to the “First euro” board, ranked by the same thing, active days. Its card keeps a timeline (listed on…, first euro on…, after N active days), and its badge keeps counting and gets a “1st €” stamp.

• Active days up to the first euro are counted from the day ledger and frozen when it is declared. The Figures page gives the median, with the count, once five apps have declared it. Before that, it says “not enough apps yet”.
• The sponsored slot on the home page is for “First euro” apps only. While an app is at zero, being seen costs it nothing.

How we read

A public repo is read the way anyone can read it on github.com, with the site's own token, asking the maker for nothing: the default branch's commit list, page by page, up to 5,000 commits. Every card is re-read every night. The “read on” line on the card is the date of that last read.

A private repo is read through its statistics, with the GitHub App's single “metadata” permission: commits per week and per author since the beginning, the per-day detail over the last 52 weeks, and recent pushes. Days older than a year are only known by the week; we record them on that week's Sunday. A ledger keeps every day seen and grows night after night. The first pass on a repo whose statistics GitHub has not computed yet walks the branch commit by commit, up to 400.

App Store and notarization

Before downloading a Mac app from a stranger, you check one thing: did it go through the App Store, or is it signed and notarized by Apple? The card answers when it can, and says where the answer comes from.

• App Store: the maker pastes their App Store link, and we verify it with Apple at every read, through the public lookup API. A link that leads to no app is not kept. We show the name and the seller exactly as Apple returns them. It is a verification, not a declaration.
• Notarization: on a public Mac app repo, we read the files in `.github/workflows`, twelve at most, and look for the tool that submits the binary to Apple notarization (`notarytool`, `stapler staple`, `altool --notarize-app`, a notarization action, notarization credentials). Found, the card says so and links to the file: anyone can go and look.
• Signed only: a Developer ID certificate with no notarization found (`codesign --sign`, `CSC_LINK`, a certificate in the secrets). Since macOS 10.15 that is no longer enough to pass Gatekeeper: the card tells them apart.

What it does not prove: a workflow that notarizes does not mean the file you download today is notarized. The only check that settles it is your own Mac when you open it — or `spctl -a -vv` on the binary. We download no binary and validate no ticket: that would take a Mac, our server is not one, and Apple exposes nothing public for it. Nothing read does not mean unsigned: plenty of makers sign from their own machine, outside any workflow. It is an absence of proof, not a proof of absence, and the card words it that way. Private repos are not read at all: the “metadata” permission gives no access to files.

What the number does not say

• An active day does not say how many hours. A one-line commit and a full day weigh the same.
• The history can come from elsewhere. A repo started from another project inherits its commits. That is why the card shows the number of authors: above one, the number is not one person's, and the card says so.
• We do not detect rewritten commits, forged dates or empty commits. A maker who wants to cheat can; they then cheat in front of everyone, on their own repo.
• Private repos read through statistics count every author for the per-day detail, bots included: GitHub does not let us tell them apart at that level.

The code

Everything written here is in the site's code, open: work.ts for the maths and the bot list, metrics.ts for the GitHub read, signing.ts for the App Store and notarization. If you find a mistake, open an issue.

Last updated: September 22, 2026.