Troubleshooting

The questions people actually ask, with the answer and what to check.

"A download went through without a verdict"

Two honest facts first, because they explain almost every case:

  • Chrome gives a download listener at most 15 seconds, and on expiry it fails open — the download proceeds. RepoGates budgets its whole decision at ~8 seconds to stay inside that, and runs a backstop that re-checks a download already in progress and cancels it late rather than never (those show as late-blocked / late-warned in the audit log). A slow machine plus a cold service worker can still lose the race. This is a browser platform ceiling, not a setting.
  • Bytes stream to a temporary file while RepoGates deliberates. A block stops the file reaching your downloads folder and discards the partial temp file — it does not mean the bytes never touched disk, and we do not claim otherwise.

Then the ordinary explanations, in the order to check them:

  1. The URL is not one RepoGates gates — it covers GitHub repository archives, release assets and raw files; it does not gate non-GitHub hosts or git clone.
  2. RepoGates is paused (Options → Protection).
  3. The repository is on your allowlist.
  4. You already proceeded or overrode for this repository this browser session.
  5. Your fail mode is open and the service was unreachable.

The audit log tells you which of these happened — every allowed path is logged with its reason.

"It says NOT CHECKED — what exactly does that mean?"

Precisely one of these, and the page says which:

  • Trial used up or expired — 10 repositories or 14 days, whichever came first.
  • Sign in — the service requires an account before it assesses anything cold.
  • Device limit — the account is signed in on more devices than the plan allows.

In every NOT CHECKED case: the repository was not examined, the badge is not a verdict, known malware is still blocked, and whatever you choose is recorded.

"RepoGates blocked something I trust"

  1. Read the findings on the decision page — the check names say exactly what fired and why.
  2. If you accept the risk and overrides are enabled, override — it is recorded and remembered for the session.
  3. For a repository you use regularly, add it to the allowlist (Options → Protection). Note the one exception: confirmed campaign-blocklist entries block even when allowlisted.
  4. Tell us: support@repogates.com with the owner/repo and the check names from the page or the audit log. False positives are measured and published — reports genuinely change the thresholds.

"The score badge / board disappeared"

The GitHub-page overlay has a server-side kill-switch for the day GitHub changes its markup, so a broken layout is never shown. When it is off, enforcement is completely unaffected — the overlay is display, the gate is the product.