Contributor Trust
Know who is behind the code before it merges.
Every pull request has someone behind it, and on a popular repo that someone is often a stranger. Contributor Trust scores the risk of each contributor on every pull request, based on account history, cross-repo behavior, and known campaign patterns, so maintainers can catch npm-style takeover attempts before merge.
Scores are private by default: visible to maintainers, never to contributors.
The Contributor trust check
The Contributor trust check runs on PR open and update on repos with the Superagent Security app installed. Signals include:
- Identity and account history
- Contribution origin patterns
- PR spray and bulk contribution behavior
- Other risk flags surfaced on the pull request
Like the other PR checks, it completes as a GitHub check run and can block merge through your branch protection rules.
How the score is calculated
Contributor Credit Score v2 uses a deterministic account-level score. It combines account and profile history, contribution distribution, original-versus-forked repositories, public social evidence, verified-commit history, and pull-request outcomes. Every observation is stored with its source status so unavailable GitHub data is not treated as negative evidence.
The composite score weights identity at 25%, behavior at 45%, and contribution content at 30%. Historical pull-request patches are reviewed separately. Concrete caution-level evidence subtracts 12 points, while suspicious or dangerous evidence may impose a harder score cap. A clean review cannot raise the deterministic score. If historical review is unavailable, the profile shows reduced confidence while retaining the deterministic result when core GitHub evidence was collected.
Some observations are contextual only. Similar README templates, public repository topics, and claimed profile location do not change the score. Superagent does not infer nationality from language, penalize blockchain work, or claim that text was AI-generated. Cross-account identity and repository correlation are not part of v2.
The Contributors page
Contributors shows every GitHub user with activity on your connected repositories, one profile per person. The table combines:
- CLA status: signed, missing, or corporate coverage for the active template version
- Trust score: the aggregate signal from contributor trust checks
- Latest pull request: recent PR activity on your repos
Open /app/contributors/[login] for a contributor's full history. CLA data comes from the Open CLA app; see Agreements for how signature coverage works.
What to monitor
- New contributors on high-traffic repos without signatures
- Failed CLA checks on open pull requests
- Low trust scores on PRs touching sensitive paths
- Re-sign campaigns after you publish a new agreement template version
Configure per repo
Contributor trust is tuned per repository. Open a repository from Repository and turn Contributor trust on or off in the security settings.