915 production repositories. 143 million lines of code. One question: how much open source software is verifiable?
| Severity | Findings | Repos |
|---|---|---|
| Critical | 4,745 | 254 |
| High | 26,580 | 698 |
| Medium | 10,584 | — |
| Info / Low | 6,991 | — |
All findings are static structural detections. Dynamic testing, fuzzing, and runtime behaviour are outside the scope of this benchmark.
| Language | Repos | Avg Score | VERIFIED | PARTIAL | UNVERIFIED |
|---|---|---|---|---|---|
| Python | 449 | 89.6 | 251 | 108 | 90 |
| JavaScript | 434 | 87.4 | 122 | 234 | 78 |
| TypeScript | 19 | 80.3 | 4 | 7 | 8 |
| Go | 4 | 86.2 | 2 | 1 | 1 |
| Unknown | 9 | 70.0 | 0 | 0 | 9 |
| Type | Count | Avg Score | VERIFIED % |
|---|---|---|---|
| CLI tool | 239 | 93.2 | 71% |
| npm package | 74 | 91.5 | 46% |
| library | 30 | 92.0 | 40% |
| API service | 218 | 86.2 | 38% |
| frontend application | 114 | 87.5 | 24% |
| web application | 156 | 83.9 | 20% |
| full-stack web application | 48 | 83.5 | 15% |
| Size | Count | Avg Score | VERIFIED % |
|---|---|---|---|
| <5K LOC | 65 | 94.0 | 80% |
| 5–20K LOC | 146 | 93.8 | 68% |
| 20–50K LOC | 221 | 91.0 | 43% |
| 50–100K LOC | 151 | 88.2 | 37% |
| 100–300K LOC | 208 | 83.5 | 24% |
| 300K–1M LOC | 108 | 80.6 | 19% |
| >1M LOC | 16 | 82.8 | 44% |
Total scanned: 143,776,584 lines of code across 584,803 files.
Largest repo scanned: 10.7M LOC (chinese-poetry/chinese-poetry).
379 repositories achieved VERIFIED in this benchmark run. Full results available via the API.
927 repositories selected from the GitHub top-starred AI and developer tools list. No curation by expected score — all repos scanned regardless of result.
Each repository is scanned by the Nucleus Proof Engine. Five critical gates: Structure, Contract, Structural Integrity, Determinism, Build. Gates are pass/fail. Score is deterministic — same code always produces the same result.
Run ID: 2026-03-12-055109. All results are cryptographically anchored. The deterministic hash of any scanned repository can be independently verified via the public API.
This benchmark measures static structural properties. It does not measure runtime behaviour, test coverage quality, or domain correctness. The Not Verified section of every certificate discloses exact scope.
| Gate | Pass Rate | Role |
|---|---|---|
| contract | 99% | Critical — near-universal |
| gate_v2 | 79% | Critical — decisive gate |
| build | 46% | Critical — splits PARTIAL/UNVERIFIED |
| gate_s / gate_d | 100% | Critical — structural baseline |
| arch | 0% | Informational — not scored |
| dependency | 0% | Informational — not scored |
| docs | 0% | Informational — not scored |
| test | 0% | Informational — not scored |
Gates marked Informational appear in reports but do not affect verdict or score.
Free verification available. No account required for public repositories.
Follow us for updates: @AlterMenta on X