Go Open-Source Supply-Chain Review
Go repository pattern findings, supply-chain review signals and scan coverage.
Report generated: 2026-11-14 17:29 UTC.
Primary repository language: Go. 659 successful scans; 659 with a score, positive coverage and complete version metadata. Mean values are grouped by version; individual scores below are review prompts, not confirmed package incidents.
| Language | Scanned repos | Repos scored | Mean index / 100 | Schema / engine / scoring |
|---|---|---|---|---|
| Go | 659 | 659 | 1.40 | 1.0.0 / 2.0.0 / heuristic-density-v1 |
Repository evidence
| Repository | Supply-chain index / 100 | Schema / engine / scoring | Lines scanned | Scan date |
|---|---|---|---|---|
| pulumi/pulumi | 40.85 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 2,362,295 | 2026-10-31 |
| agones-dev/agones | 38.22 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 242,745 | 2026-10-31 |
| dlvhdr/gh-dash | 35.53 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 46,421 | 2026-10-31 |
| gruntwork-io/terratest | 32.42 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 150,959 | 2026-10-31 |
| certimate-go/certimate | 29.13 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 197,460 | 2026-10-31 |
| charmbracelet/vhs | 29.00 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 21,231 | 2026-10-31 |
| charmbracelet/soft-serve | 21.75 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 33,642 | 2026-10-31 |
| treeverse/lakeFS | 17.74 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 443,905 | 2026-10-31 |
| derailed/k9s | 15.31 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 105,340 | 2026-10-31 |
| k0sproject/k0s | 14.87 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 136,638 | 2026-10-31 |
| CJackHwang/ds2api | 12.43 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 90,060 | 2026-10-31 |
| google/gvisor | 11.19 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 865,794 | 2026-10-31 |
| kubevela/kubevela | 10.11 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 564,605 | 2026-10-31 |
| sipeed/picoclaw | 9.50 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 373,404 | 2026-10-31 |
| taubyte/tau | 9.02 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 318,982 | 2026-10-31 |
| go-vikunja/vikunja | 8.81 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 454,643 | 2026-10-31 |
| ory/hydra | 7.91 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 306,730 | 2026-10-31 |
| flyteorg/flyte | 7.63 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 542,522 | 2026-10-31 |
| authelia/authelia | 7.34 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 428,316 | 2026-10-31 |
| hatchet-dev/hatchet | 7.02 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 987,582 | 2026-10-31 |
| gofiber/fiber | 7.00 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 245,765 | 2026-10-31 |
| loft-sh/vcluster | 6.76 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 181,481 | 2026-10-31 |
| infiniflow/ragflow | 6.66 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 1,470,678 | 2026-10-31 |
| The-Vibe-Company/Quivr | 6.63 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 433,708 | 2026-10-31 |
| drakkan/sftpgo | 6.50 | 1.0.0 / 2.0.0 / heuristic-density-v1 | 197,207 | 2026-10-31 |
Pattern signals are prompts for human review, not proof of AI authorship, security vulnerabilities, missing packages, measured review time or code quality. Selection, scan coverage and scoring versions limit comparisons.