Check C5 · provenance family · severity MEDIUM · automatic · one of the 22 checks
The question this check asks: who actually wrote this — one account, or a community? And if several accounts appear, does one of them hold nearly everything?
The OpenSSF Scorecard's Contributors check wants at least three organisations across the last thirty commits, because code that several unrelated people have touched has been read by several unrelated people. One account holding more than 95% of the commits is one of two things: a bus-factor problem, or a sockpuppet crew — a handful of accounts run by one operator to make a repository look collaborative. The repository vetting standard notes the trap in the obvious cross-check: the company field on a profile is self-declared and spoofable, so "three accounts from three companies" proves nothing on its own.
On the surviving FakeGit repositories we scanned live, a single contributor was the second most common finding — 21 of 100 — behind only the missing licence. Both are weak on their own and discriminating in aggregate, which is exactly how they are scored.
C5 reads the contributors API and produces one of two findings, both at severity MEDIUM and both worth 4 points.
Single contributor — the list has exactly one account. The note reads “one contributor — single point of failure”. The verdict is REVIEW at a score of 96, and the default personal policy sets this finding to allow: it is on the board, and the download proceeds. The evidence note in the scoring table:
“common in legit small projects”
Contributor concentration — fewer than four accounts, and the top one holds more than 95% of the commits. The note reads “97% of commits from one account across 3”. The verdict is REVIEW at 96, and the default policy warns: the download is held and the finding shown, because this is the shape that is either a sockpuppet or a maintainer whose two collaborators fixed a typo each. The evidence note:
“sockpuppet or bus-factor”
Both thresholds are policy parameters (concentration_top_share, concentration_max_contributors). Neither finding blocks on its own, and neither should.
Almost every personal project, every early-stage tool, every research artefact. One person wrote it, because one person needed it. That is why the single-contributor line is 4 points and allowed by default — the standard calls the whole licence-activity-contributors group "necessary, nowhere near sufficient", and the weights say the same. The concentration finding fires on a maintainer with a couple of drive-by contributors, which is most small projects with any contributors at all; the warning is a prompt to read the commit history, and the decision is yours.
It counts commits by account. A history that was cloned from a real project — which the press asserted about FakeGit without per-repository evidence — carries the real project's authors, and looks like a community. Several accounts run by one operator are several accounts here. And the number of authors says nothing about whether any of them read the code before it shipped. This finding is about who could have reviewed a change, not about what the change was.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser.
Without installing anything: the Contributors link on the repository page lists accounts by commit count. Click the top one and the second one; two accounts created the same week, with nothing else on either, are one operator. With the GitHub CLI:
gh api repos/OWNER/REPO/contributors --jq '.[:5][] | "\(.login)\t\(.contributions)"'Then open the second-largest contributor's profile and read their history. A genuine collaborator has one.
Is a one-person project a risk? Most useful software starts as one. A single contributor costs 4 points and the default policy does not act on it — the line is on the board so you know nobody reviewed the code but its author, which is a bus-factor fact rather than a security verdict. It becomes part of a picture when the single account is also weeks old.
What is the difference between the two findings? Single contributor means the contributors list has exactly one account. Contributor concentration means there are two or three accounts and one of them holds more than 95% of the commits — the shape of a sockpuppet crew, or of a maintainer with occasional drive-by fixes. Both cost 4 points; concentration warns by default and single contributor does not.
Does RepoGates stop git clone? No. Browser-initiated downloads only.
C1 Owner account age — the account behind the one contributor · C6 Licence — the other weak-alone, strong-in-aggregate finding on campaign survivors · C7 Maintenance activity — the rest of the OpenSSF baseline.
Add RepoGates to Chrome Pricing
Numbers on this page: OpenSSF Scorecard Contributors check; Phase 0 live tier of 2026-08-14 (100 surviving campaign repositories); thresholds and weights from the product's policy and scoring tables.