Check C1 · provenance family · severity CRITICAL · automatic · one of the 22 checks
The question this check asks: how old is the GitHub account that owns this repository? Not the repository — the account. A project can be new for good reasons; a maintainer who did not exist three months ago is a different kind of new.
The FakeGit campaign of 2026 published roughly 7,600 repositories from about 6,600 fabricated accounts, most of them created shortly before the repositories they owned. An account with no prior public history is the cheapest thing in that operation to manufacture and the hardest to hide: created_at is a public field and it does not backdate. That is why the repository vetting standard calls account age the single highest-value provenance signal of 2026, and why it is check number one.
It is also the check our own honesty rests on. When we measured RepoGates against all 7,648 attributed campaign repositories, this check fired on 4,863 of the 4,952 repositories that any provenance check caught — the headline catch rate was, in effect, this one signal. We then validated the account ages against the live API and published the correction that cut that headline from 65% to roughly a third. The measurement page and the FakeGit intelligence page have the whole story.
C1 reads the owner's created_at from the users API and compares it with two thresholds. An account under 90 days old is CRITICAL and costs 45 points; an account under a year old is HIGH and costs 18 points. Because the verdict follows the most severe finding, a critical C1 on its own is a BLOCK — the default personal policy blocks on it, and the decision page says “maintainer account is N days old — FakeGit used ~6,600 fresh accounts”. A HIGH C1 on its own scores 82 and reads REVIEW: the badge is still green, the gate warns rather than blocks, and the note says the account is under a year old.
The evidence note in the scoring table explains the weight:
“0.0% FP at CRIT on top-100 controls; the FakeGit signature signal”
That is the whole justification. On 80 popular, legitimate repositories the critical grade fired on none of them. Both thresholds are policy parameters (owner_age_crit_days, owner_age_high_days); a strict organisation profile raises the critical line to 180 days.
A newcomer's first project. In our Phase 0 controls, 50 young legitimate repositories (under five months old, at least 100 stars) produced 3 critical-grade C1 hits — 6.0%. Those were real people with real projects on genuinely fresh accounts, and the check cannot tell them from a fabricated account, because on the day of the download there is no difference to see. What the board does is show you the number — “maintainer account is 41 days old” — so the judgement is yours, and an override records the reason for the audit log on your machine.
A second, subtler case: an old account that was dormant and became active. That does not fire C1 at all (the account is old), but it is the pattern the next paragraph is about.
Roughly half of the FakeGit campaign sat on accounts with years of prior public history. Of the 2,647 campaign repositories our provenance checks missed, 1,252 belonged to accounts one to two years old, 1,062 to accounts two to five years old, and 330 to accounts older than five years. Aged, purchased, or compromised accounts pass this check by construction, and after GitHub's takedowns removed the fresh-account cohort first, the repositories still alive were mostly this kind: a live scan of 100 survivors found a provenance hit on only 20. C1 catches the cheap half of the operation. The expensive half is the job of the release-asset check, the execution-surface checks and the agent-surface checks — not of any account field.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser.
Without installing anything: open the owner's profile page. The Joined date is under the avatar, and the contribution graph shows whether the account has a history that predates this repository. With the GitHub CLI:
gh api users/OWNER --jq '{created_at, public_repos, followers}'Then compare created_at with the repository's own creation date. An account and a repository created in the same week, with nothing else on the account, is the FakeGit shape. An account from 2019 with a hundred unrelated commits is not — and if it is still shipping something you do not trust, that is what the other 21 checks are for.
Does a new GitHub account mean the repository is malicious? No. Every developer's first repository sits on a new account. In our measurement 3 of 50 young, legitimate, well-starred repositories fired this check at block grade — a 6% cost we state rather than hide. The decision page shows the account's age in days so you can judge it, and an override records why.
Why is account age worth more than stars? Stars are a purchased commodity — CMU's ICSE 2026 study identified around 6 million suspected fake stars. Years of unrelated public history on one account are hard to fabricate. FakeGit's roughly 6,600 accounts were fresh, and on the top 100 repositories this check blocked none: 0.0% false positives at the critical grade.
Does RepoGates stop git clone? No. Browser-initiated downloads only.
C2 Repository age — the repository rather than the account; 12 points, HIGH, fires on the same campaign shape · C3 Star velocity and traction — stars that outrun the account's age, the bought-star variant · C9 Release-asset binaries — the delivery path, and the check that sees the half of the campaign this one cannot.
Add RepoGates to Chrome Pricing
Numbers on this page: Phase 0 measurement of 2026-08-14 (7,648 attributed slugs, thresholds pre-committed in git before any result was seen); campaign totals as published by Island and BleepingComputer, July 2026; weights from the product's scoring table.