Point Repo Anti-Rot at any public git repo and it will measure the decay — secrets, stale branches, dead code and dependency rot — then hand you a health grade.
No account, no install. The repository is cloned to a temporary directory, read, and deleted when the scan finishes.
Search GitHub or paste a repository URL, then add it to the list. Everything in the list is cloned and scanned by the Repo Anti-Rot engine — no mock data.
Selected — 0 of 20
Nothing selected yet. Search above, or paste a repository URL.
Or try a known public repo — pick one, or compare two:
01the checks
Every one is calibrated against real repositories before it ships — the rule only stays if it stays quiet on projects that are doing it right.
false positives are bugs
Credentials committed to the working tree or buried in history, dependencies with published advisories, dangerous constructs in your own code, and workflows that hand a stranger your token.
Packages that stopped being maintained, runtimes past their end-of-life date, lockfiles that disagree with the manifest, and licenses that are incompatible with the one you ship under.
Whether the green badge means anything: silenced failures, tests no workflow runs, and two config files where one is silently ignored.
Instructions that no longer work — a documented script that does not exist, a badge for a deleted workflow, links that have gone dead.
The findings that appear on their own, with no commit behind them: branches nobody came back to, TODOs that aged into archaeology, files only one person has ever touched.
Exports nothing imports, blocks duplicated verbatim, commented-out code, forgotten debug statements and disabled tests.
calibration
A check that fires on a healthy repository is a bug, not a finding. Every rule runs against the corpus before it ships.
02the maths
A score out of 100, starting at 100 and losing points per finding: −10 for a critical, −3 for a warning, −0.25 for an info note. Past the first few of a kind, each additional finding costs less than the last — so a pile of small notes can never cost a whole grade band, and none of them is ever free.
A
A means the scan found little that costs points — not that the repo is perfect.
F
F means enough weight of findings that the score fell below the last band.
Each additional finding of a kind costs less than the last — never nothing, so clearing any of them still helps.
03the fine print
The repository is cloned into a temporary directory on the server, read, and deleted when the scan finishes. History reports are reused from cache for 24 hours; expired entries are removed on later cache writes.
The current scan report stays in this browser. Sharing stores a summary without file paths or snippets. Optional hosted AI sends finding titles and categories to OpenRouter with your opt-in. Recommendations are reused for 24 hours; expired cache entries and backups have separate retention.
Two rows per scan, in two tables that cannot be joined. One counts usage: a random browser id, the event, and the repository name — no score. The other records the result's shape — score, grade, main language, size band, findings per severity — with no name, no address and no browser id, so a score is never attached to a project. Never file paths, code, IP addresses or user agents.
04automation
The same engine runs as a GitHub Action on every push: it fails the build below a grade you choose, uploads SARIF so findings appear in the Security tab, and comments the breakdown on the pull request.
Scans from CI also keep a health badge current — the one at the top of this project's own README.
on: [push, pull_request]
jobs:
anti-rot:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: YpCIIIaK/repo-janitor@v1
with:
fail-on: B
sarif-file: repo-anti-rot.sarif