Check G5 · provenance family · severity MEDIUM · automatic · one of the 22 GitLab checks
The question this check asks: who actually wrote this — one identity, or a community? And if several appear, does one of them hold nearly everything?
The OpenSSF Scorecard's Contributors check wants at least three organisations across the last thirty commits, because code that several unrelated people have touched has been read by several unrelated people. One identity holding more than 95% of the commits is one of two things: a bus-factor problem, or a sockpuppet crew — a handful of names run by one operator to make a project look collaborative. Scorecard itself does not cover gitlab.com (that is the G8 page's whole story), so this check is where its contributors question gets asked here.
On GitHub the finding earned its place on the surviving FakeGit repositories, where a single contributor was the second most common finding — 21 of 100 — behind only the missing licence. There is no gitlab.com exemplar set to repeat that on: no gitlab.com campaign of the FakeGit shape exists in the 2024–2026 record, so there is no catch figure for this page to give. What there is, is a false-positive run, below, and the GitLab intelligence page for the rest.
G5 reads gitlab.com's contributors endpoint and produces one of two findings, both at severity MEDIUM and both worth 4 points — the C5 page's rules, unchanged.
Single contributor — the list has exactly one identity. The note reads “one contributor — single point of failure”. The verdict is REVIEW at a score of 96, and the default personal policy sets this finding to allow: it is on the board, and the download proceeds. Contributor concentration — fewer than four identities, and the top one holds more than 95% of the commits. The note reads “97% of commits from one account across 3”; the verdict is REVIEW at 96, and the default policy warns. Both thresholds are policy parameters (concentration_top_share, concentration_max_contributors). Neither blocks on its own.
What changes is what a “contributor” is. GitHub's list is keyed by account. gitlab.com's /repository/contributors is keyed by git identity — the author name and e-mail on the commits, merge commits excluded and no user id attached — and gitlab.com does not sort it, so RepoGates asks for the top 100 by commit count, sorts them itself, and keeps the name and the count. The e-mail addresses are dropped before anything is stored; they never leave the scan.
Measured on 19 September 2026 over the 100 most-starred gitlab.com projects, anonymously, through the same code as /v1/gl/score: 5 single-contributor findings and 1 concentration finding — gitlab-org/gitlab-foss, whose mirrored history arrives under one identity. Neither was the sole driver of any of the 84 REVIEWs.
Almost every personal project, every early-stage tool, every research artefact — one person wrote it, because one person needed it. That is why the single-contributor line is 4 points and allowed by default. gitlab.com adds a case of its own: because the list is keyed by git identity rather than account, one maintainer who has committed under two e-mail addresses is two contributors here, and a project whose history was imported from elsewhere carries whatever author strings the import kept — the gitlab-foss finding is that shape. The concentration finding fires on a maintainer with a couple of drive-by contributors, which is most small projects with any contributors at all; the warning is a prompt to read the commit history, and the decision is yours.
It counts commits by git author string, and an author string is free text: several names run by one operator are several contributors here, and no account, verified e-mail or sign-up date stands behind any of them — gitlab.com's list carries none. A history cloned from a real project carries the real project's authors and looks like a community. And the number of authors says nothing about whether any of them read the code before it shipped. This finding is about who could have reviewed a change, not about what the change was.
RepoGates runs the same 22 checks on a gitlab.com project that it runs on a GitHub repository, from gitlab.com's public API, under the key gl/{namespace…}/{project}. What that API withholds from an anonymous caller — fork status, a user namespace's account age, and OpenSSF Scorecard, which does not cover gitlab.com — is listed as not checked, never assumed. A self-managed GitLab is another hostname and is not assessed. The repository's code is not read on this tier: a PASS means the provenance and the declared execution surface are clean.
Without installing anything: the contributors endpoint answers to anyone on a public project, sorted by commits if you ask it to — the path URL-encoded:
curl -s 'https://gitlab.com/api/v4/projects/NAMESPACE%2FPROJECT/repository/contributors?order_by=commits&sort=desc&per_page=5' | jq '.[] | "\(.name)\t\(.commits)"'Then look for the second-largest name in the commit history. A genuine collaborator has a history behind the name; an author string has only the string.
Is a one-person project a risk? Most useful software starts as one. A single contributor costs 4 points and the default policy does not act on it — the line is on the board so you know nobody reviewed the code but its author, which is a bus-factor fact rather than a security verdict. Five of the 100 most-starred gitlab.com projects carry it. It becomes part of a picture when the namespace behind the one identity is also weeks old.
What does gitlab.com's contributors list count? Git identities — the author name and e-mail on the commits, merge commits excluded — not GitLab accounts, and gitlab.com does not sort it. RepoGates asks for the top 100 by commits, sorts them itself, keeps the name and the count, and drops the e-mail addresses before anything is stored. Single contributor means one identity; concentration means fewer than four with one above 95% of the commits. Both cost 4 points; concentration warns by default and single contributor does not.
Does RepoGates hold a download from gitlab.com in the browser? Not yet. The extension does not run on gitlab.com pages; the board and the download hold there are a later, separate store release. Today a gitlab.com project is assessed on request — through the verdict API (GET /v1/gl/score/{path}), the MCP server (check_repo with platform="gl") and the preflight, which judges a command line that names a gitlab.com project: git clone https://gitlab.com/…, glab repo clone, or a pasted project, archive or release-download URL.
C5 Contributor concentration — the GitHub original · G1 Owner account age — the namespace behind the one identity · G6 Licence — the other weak-alone finding, and the one that did drive a REVIEW on the top-100 · G7 Maintenance activity — the rest of the OpenSSF baseline.
Add RepoGates to Chrome Pricing
Numbers on this page: the 19 September 2026 measurement of the 100 most-starred gitlab.com projects, run anonymously through the same code as /v1/gl/score; the anonymous gitlab.com API reads of 18 September 2026 (what the contributors endpoint returns); OpenSSF Scorecard's Contributors check; the C5 page's Phase 0 live tier where GitHub is cited; thresholds and weights from the product's policy and scoring tables.