Check a public repository for maintenance issues, inspect the evidence, and get a prioritized plan of what to improve first.
No account, no install. The repository is cloned to a temporary directory, read, and deleted when the scan finishes.
Search GitHub or paste a repository URL, then add it to the list. Everything in the list is cloned and scanned by the Repo Janitor engine — no mock data.
Selected — 0 of 20
Nothing selected yet. Search above, or paste a repository URL.
Or try a known public repo — pick one, or compare two:
See affected files, severity, and the reason behind each finding. Verify the context before making changes.
Open the prioritized action plan with suggested steps and ways to verify a fix.
Scan again after a change. Add the CLI or GitHub Action when you want checks in your workflow.
The score describes repository maintenance signals, not proven security. Findings can need project-specific context; inspect the evidence and report false positives.
01the checks
Explore checks for security, dependencies, configuration and maintenance. Each finding includes an explanation so you can assess it in your project's context.
false positives are bugs
Credentials committed to the working tree or buried in history, dependencies with published advisories, dangerous constructs in your own code, and workflows that hand a stranger your token.
Packages that stopped being maintained, runtimes past their end-of-life date, lockfiles that disagree with the manifest, and licenses that are incompatible with the one you ship under.
Whether the green badge means anything: silenced failures, tests no workflow runs, and two config files where one is silently ignored.
Instructions that no longer work — a documented script that does not exist, a badge for a deleted workflow, links that have gone dead.
The findings that appear on their own, with no commit behind them: branches nobody came back to, TODOs that aged into archaeology, files only one person has ever touched.
Exports nothing imports, blocks duplicated verbatim, commented-out code, forgotten debug statements and disabled tests.
calibration
Rules can misinterpret project context. Report incorrect findings so we can reproduce them and add regression tests.
02the maths
A score out of 100: base penalties are −10 for a critical finding, −3 for a warning and −0.25 for an informational note. Repeated findings taper. In new scans, informational notes together subtract at most 10 points; warnings and critical findings remain uncapped.
A
A means the scan found little that costs points — not that the repo is perfect.
F
F means enough weight of findings that the score fell below the last band.
Repeated findings have a reduced impact. All findings remain visible, even when resolving one does not change the rounded score.
03the fine print
The repository is cloned into a temporary directory on the server, read, and deleted when the scan finishes. History reports are reused from cache for 24 hours; expired entries are removed on later cache writes.
The current scan report stays in this browser. Sharing stores a summary without file paths or snippets. Optional hosted AI sends finding titles and categories to OpenRouter with your opt-in. Recommendations are reused for 24 hours; expired cache entries and backups have separate retention.
Two rows per scan, in two tables that cannot be joined. One counts usage: a random browser id, the event, and the repository name — no score. The other records the result's shape — score, grade, main language, size band, findings per severity — with no name, no address and no browser id, so a score is never attached to a project. Never file paths, code, IP addresses or user agents.
04automation
The same engine runs as a GitHub Action on every push: it fails the build below a grade you choose, uploads SARIF so findings appear in the Security tab, and comments the breakdown on the pull request.
Scans from CI also keep a health badge current — the one at the top of this project's own README.
on: [push, pull_request]
jobs:
anti-rot:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: YpCIIIaK/repo-janitor@v1
with:
fail-on: B
sarif-file: repo-anti-rot.sarif