How an edition is made

Each edition has up to 45 repositories in ten sections. Each repository has one primary section and counts once.

• 🗡️Offensive Security & AI Pentesting
• 📊Detection Engineering, SIEM & SOC
• 🔬DFIR, Threat Hunting & Reverse Engineering
• 🔍AppSec, Code Scanning & Supply Chain
• ☁️Cloud, Identity & Infrastructure Security
• 🛡️AI Security & Agent Auditing
• 🛰️Threat Intelligence & OSINT
• 🤖AI Agents & Self-Hosted Models
• 🏠Homelab, IoT & Self-Hosting
• 🧪Wildcard / Emerging

Section sizes are targets, not quotas. When a section has fewer genuine movers, the edition publishes fewer and says so; it never pads. Everything in Offensive Security is labelled dual-use: use it only within an authorised scope.

• Repositories are ranked within their section by net star change: current stars minus the stars at the start of the window. That is not the same as new stars, because people also remove stars.
• Every change states its window in hours. Monday covers about 72 hours since Friday; Wednesday and Friday about 48.
• A repository seen for the first time has no baseline. It shows “no baseline”, never zero.
• Small repositories can’t win on percentages: a repository needs at least 100 stars to be watched and a gain of at least 5 stars in the window to be listed. Sections are never padded.
• Top movers are the biggest section leaders, at most one per section, so one busy field can’t take the whole opening story.
• The lab pick is the highest-ranked repository with no risk indicators, an advisory check that completed with none found, a release in the last 90 days, a measured starting figure, and that is neither archived nor a curated list. Dual-use tools can be picked and keep their label. If none qualifies, there is no lab pick.
• When a repository joins the watch list, its last seven days are estimated from GitHub’s daily star history. Those estimates count new stars only, not removed ones, so a change measured from one is marked estimated. Once our own daily snapshots cover a window, they are used instead.
• Unknown values stay unknown. Pull-request counts that weren’t collected read “not collected”, and a day without an observation is a gap in the history, never filled in.

Some repositories show risk indicators. They are signals worth a closer look, not accusations or verdicts, and a flagged repository is never the lab pick.

• Stars outrun work: at least 300 stars gained with no commits, issue activity or merged pull requests in the window.
• One-day spike: at least 70% of the window’s new stars (and at least 200) arrived on a single UTC day.
• New owner account: the owner’s account is younger than 90 days.
• Instant fame: created in the last 30 days, with at least 1,000 stars.
• Look-alike name: within one character of a watched project by another owner with at least ten times the stars.
• Risky install: the README pipes a download straight into a shell, or runs decoded base64, found by reading text only.

Sources are read in this order: the project on GitHub (README, releases, security policy and advisories), Hacker News, OSV and deps.dev, OpenSSF Scorecard, the CISA Known Exploited Vulnerabilities catalogue and, only when free sources can’t explain a move, a capped web search. Every claim links to a fetched source with the date it was retrieved. Without a source, the repository is marked research limited, and a move with no source is unexplained.

Fresh

researched for this edition.

Cached

reused from an earlier edition, showing its original retrieval date.

Project sources only

only the project’s own pages were available.

Deferred

skipped because the run reached its research budget.

Failed

the lookups failed.

Each check is read-only and records one of four states: found, not found, unknown (the check couldn’t be completed) or n/a (it doesn’t apply), always with a reason for the last two.

• Security policy or vulnerability-reporting process.
• Advisories that affect the latest version, from GHSA, OSV and deps.dev, with CISA KEV matches. Earlier advisories that list a patched version are noted as history, so a project isn’t penalised for fixing and disclosing.
• OpenSSF Scorecard’s own result and date. It is Scorecard’s score, not ours.
• Published checksums, signatures or attestations. Published is not the same as verified.
• Risky install patterns in the README.
• Archived or unmaintained.

• “No advisory found” never means safe. It means no advisory was found by these sources on that date.
• Nothing is run. No reported repository is installed, built or executed, and its artifacts are never loaded. The lab pick is worth investigating in an isolated lab; it is not a recommendation to run it anywhere else.
• READMEs, web pages and model output are treated as untrusted data and are never followed as instructions. The model can’t choose what is ranked, flagged or picked.
• Everything runs on free tiers with hard caps. When a cap is reached, research is marked deferred rather than paid for.

If a claim, flag or number about your project is wrong, email mrdellybot@gmail.com with the repository and the edition date. Corrections are published as a new revision of the edition; history is never rewritten.