Method

A “verified” number is only worth something if we show how we verify.

What we count

An active day is a calendar day (UTC) with at least one human commit on the repo's default branch. Ten commits on the same day count as one day. One commit at 23:59 and another at 00:01 count as two. It is the only number that ranks.

• Commits: the total of human commits read.
• Best streak: the longest run of consecutive weeks (Monday to Sunday) with at least one active day.
• Lifetime: the months between the first and the last commit.
• Authors: the distinct people found in the history, bots excluded. And the maker's share: the commits signed by their GitHub account. When it drops under 80%, the card says so. A card can have up to two co-makers, added by GitHub login and visible once they have signed in: their commits count in that share.
• GitHub stars: shown, never used to rank. They tell who has not been noticed yet.

What we exclude

• Bots: dependabot, renovate, github-actions, semantic-release, snyk, imgbot, copilot and any account GitHub flags as “Bot”. Their commits make neither a day nor an author.
• Other branches: only the default branch is read. Work on a branch never merged does not show.
• Content: never a line of code, never a commit message. Only dates and author names.
• Paid apps: they can have a card, they are not on the board.

How we read

A public repo is read the way anyone can read it on github.com, with the site's own token, asking the maker for nothing: the default branch's commit list, page by page, up to 5,000 commits. Every card is re-read every night. The “read on” line on the card is the date of that last read.

A private repo is read through its statistics, with the GitHub App's single “metadata” permission: commits per week and per author since the beginning, the per-day detail over the last 52 weeks, and recent pushes. Days older than a year are only known by the week; we record them on that week's Sunday. A ledger keeps every day seen and grows night after night. The first pass on a repo whose statistics GitHub has not computed yet walks the branch commit by commit, up to 400.

App Store and notarization

Before downloading a Mac app from a stranger, you check one thing: did it go through the App Store, or is it signed and notarized by Apple? The card answers when it can, and says where the answer comes from.

• App Store: the maker pastes their App Store link, and we verify it with Apple at every read, through the public lookup API. A link that leads to no app is not kept. We show the name and the seller exactly as Apple returns them. It is a verification, not a declaration.
• Notarization: on a public Mac app repo, we read the files in `.github/workflows`, twelve at most, and look for the tool that submits the binary to Apple notarization (`notarytool`, `stapler staple`, `altool --notarize-app`, a notarization action, notarization credentials). Found, the card says so and links to the file: anyone can go and look.
• Signed only: a Developer ID certificate with no notarization found (`codesign --sign`, `CSC_LINK`, a certificate in the secrets). Since macOS 10.15 that is no longer enough to pass Gatekeeper: the card tells them apart.

What it does not prove: a workflow that notarizes does not mean the file you download today is notarized. The only check that settles it is your own Mac when you open it — or `spctl -a -vv` on the binary. We download no binary and validate no ticket: that would take a Mac, our server is not one, and Apple exposes nothing public for it. Nothing read does not mean unsigned: plenty of makers sign from their own machine, outside any workflow. It is an absence of proof, not a proof of absence, and the card words it that way. Private repos are not read at all: the “metadata” permission gives no access to files.

What the number does not say

• An active day does not say how many hours. A one-line commit and a full day weigh the same.
• The history can come from elsewhere. A repo started from another project inherits its commits. That is why the card shows the number of authors: above one, the number is not one person's, and the card says so.
• We do not detect rewritten commits, forged dates or empty commits. A maker who wants to cheat can; they then cheat in front of everyone, on their own repo.
• Private repos read through statistics count every author for the per-day detail, bots included: GitHub does not let us tell them apart at that level.

The code

Everything written here is in the site's code, open: work.ts for the maths and the bot list, metrics.ts for the GitHub read, signing.ts for the App Store and notarization. If you find a mistake, open an issue.

Last updated: September 18, 2026.