Check C2 · provenance family · severity HIGH · automatic · one of the 22 checks
The question this check asks: how old is this repository at the moment you are downloading from it? Not the account — the repository, from its own created_at.
A campaign has to make its repositories fast. At its peak in April 2026, FakeGit was creating roughly 300 AI-themed repositories a month, and a victim met most of them within weeks of their creation — the repositories needed to exist only long enough to be found, downloaded from, and taken down. In our Phase 0 measurement, with ages evaluated at the moment each repository was last seen alive rather than today, this check fired on 266 of the campaign's repositories. The same repositories, if any still existed, would all pass it now; the check is about the moment of encounter, which is the moment the gate runs.
It is the weaker sibling of the account-age check, and deliberately so: a new repository is ordinary, a new maintainer with a popular repository is not.
C2 reads the repository's creation date. A repository under 30 days old fires at severity HIGH and costs 12 points; a repository that trips nothing else scores 88, the badge stays green, and the verdict reads REVIEW — the download is held, the finding says “repository created N days ago”, and proceeding is one click, recorded. It never blocks on its own. The threshold is a policy parameter (repo_age_high_days, 7 to 180); the strict organisation profile sets 90. The evidence note in the scoring table:
“C2; young repos are risky but common (6% of young-legit controls were fresh accounts)”
Read that note carefully, because it is about the other check: of 50 young, legitimate repositories, three sat on accounts fresh enough to block. Youth of the repository alone was common enough to be worth a warning and no more.
Every project, for its first month. There is no way to tell a three-week-old project from a three-week-old lure by the date, and the check does not try — it puts the number on the board so the other 21 checks, and you, can weigh it. A young repository from an account with years of history is the normal case and the gate merely mentions it. A young repository from a young account is where the account-age check takes over.
Old repositories with new contents. A repository created years ago and repurposed — its history rewritten, or a release attached last week to a project that has been dormant — passes this check by construction. Age says nothing about what is in the tree or on the releases page; the release-asset check and the execution-surface checks are about content, and this one is not. It also cannot see a repository that has been renamed into place: a transfer keeps the original creation date.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser.
Without installing anything: the repository page does not show its creation date, but the first commit does — open the commit history and go to the last page. With the GitHub CLI, the three fields worth reading together:
gh api repos/OWNER/REPO --jq '{created_at, pushed_at, stargazers_count}'Then compare created_at with the owner's Joined date. Created in the same week as the account, with a release already attached, is the shape this check exists to mention.
Is a new repository a risk? Every repository is new for its first thirty days, so on its own the answer is no — which is why the check costs 12 points and warns rather than blocks. It matters in combination: a repository created this month, on an account created this month, shipping a binary release, is the FakeGit shape, and the account-age check is the one that blocks.
Why 30 days? It is the owner's example from the policy model and it is a policy parameter, not a constant — organisations can set it anywhere from 7 to 180 days, and the strict profile uses 90. At the FakeGit peak the campaign created roughly 300 AI-themed repositories a month; a victim met most of them within their first weeks.
Does RepoGates stop git clone? No. Browser-initiated downloads only.
C1 Owner account age — the check that blocks when both are young · C3 Star velocity and traction — stars divided by this age · C9 Release-asset binaries — what a week-old repository should not already have.
Add RepoGates to Chrome Pricing
Numbers on this page: Island, July 2026 (campaign creation rate); Phase 0 measurement of 2026-08-14 (266 repo-age hits at encounter time; 50 young-legit controls); thresholds and weights from the product's policy and scoring tables.