A real report — the exact format you receive
This is a real report generated for the pallets/flask open-source project — the same pipeline paying customers get, run over the repository's own git history. The buyer's framing for this run: acquisition or investment diligence. Every number carries an inline note on exactly how it was computed. Report dated July 15, 2026; the analysis window is the 24 months before that date.
Executive summary
flask is a healthy, actively maintained codebase with one material structural risk: continuity. Activity is steady — 487 non-merge commits across 22 of the last 24 months, a median of 19 per month — and engineering discipline is strong: 58% of source-touching commits also touch tests, CI is configured and running, and the docs are fresh (touched 12 days before this report). The concentration picture is the finding a diligence reviewer should carry forward: one author accounts for 71% of all commits in the window, and the core src/flask directory has a bus factor of 1 — 83% of its commits come from that same author. This is a well-run project whose day-to-day health is not in question; its dependency on a single individual is.
The numbers
Commit & author activity
- 487 non-merge commits in the window
- active in 22 of the last 24 months; median 19 commits/month
- 61 distinct authors
How we computed this
Counted non-merge commits on the default branch over the 24 calendar months ending 2026-07-15, from the repository's own git history. 'Active month' = at least one non-merge commit in that month. Median is over the 24 monthly counts.
Author concentration
- top author accounts for 71% of window commits
- top 3 authors account for 88%
How we computed this
Attributed each of the 487 non-merge commits in the window to its git author (by normalized email). Top-author share = commits by the single most frequent author ÷ total; top-3 share = the three most frequent authors ÷ total.
Bus factor by directory
- overall bus factor: 1
src/flask— bus factor 1, 83% from the dominant authortests— bus factor 2, 64% from the dominant authordocs— bus factor 3, 52% from the dominant author
How we computed this
For each directory, bus factor = the smallest number of authors who together account for ≥50% of commits touching that directory in the window. Overall = the median across directories that received ≥10 commits. Dominant-author share = the largest single author's share of that directory's commits.
Churn hotspots
src/flask/app.py— 64 commitssrc/flask/ctx.py— 41 commitstests/test_basic.py— 38 commits
How we computed this
Counted, per file, the number of non-merge commits in the window that modified the file. Listed the three files with the highest counts. High churn on core modules signals where change (and defect risk) concentrates.
Test signal
- test-to-source commit ratio: 0.42
- 58% of source-touching commits also touch tests
How we computed this
Classified each commit as test-touching (any modified path matching tests/ or *_test.* / test_*) or source-touching. Ratio = test-touching commits ÷ source-touching commits. Second figure = the fraction of source-touching commits that also touched at least one test file.
CI presence
CI configured — workflows: tests.yaml, release.yaml.
How we computed this
Looked for CI configuration at the repo root: .github/workflows/*.yml, .gitlab-ci.yml, .circleci/, azure-pipelines.yml, or Jenkinsfile. Listed the workflow files found.
Dependency freshness
- 8 runtime dependencies declared
- 3 with upper-bound version pins
- 1 stale by a major version
How we computed this
Parsed the dependency manifest (pyproject.toml / package.json / go.mod, whichever exists at the root) and counted declared runtime dependencies. 'Upper bounds' = declarations with a maximum-version pin. 'Stale by major versions' = dependencies whose resolved version is at least one major release behind the latest published release on the package registry, checked at generation time.
Docs freshness
- README last touched 47 days ago
- docs/ last touched 12 days ago
- contributing guide: present
How we computed this
Days between the report generation date (2026-07-15) and the most recent commit touching README* at the root, and any file under docs/, respectively. Contributing guide = presence of CONTRIBUTING* at the root or under .github/.
Concentration & continuity risk
Across 61 distinct authors in the 24-month window, the top author holds a 71% commit share and the top three hold 88%. The per-directory view sharpens this: src/flask (the framework core) has a bus factor of 1 with an 83% dominant-author share, while tests (bus factor 2) and docs (bus factor 3) are more broadly held. Read: institutional knowledge of the core module lives with one person. In an acquisition or inheritance scenario, the practical follow-up is a transition plan for that author and a maintainer-succession conversation — not a code-quality remediation.
Delivery & maintenance signals
Churn concentrates where you'd expect in a mature framework: app.py (64 commits), ctx.py (41), and the main test module (38) — core request-lifecycle code that changes as behavior is refined, not scatter-shot firefighting. Test discipline is visible in the history, not just claimed: 42% as many test-touching commits as source-touching ones, and over half of source changes ship with a test change. CI is configured (tests and release workflows). Dependencies are modest (8 runtime declarations) with 3 carrying upper bounds and 1 stale by a major version at generation time — a small, actionable maintenance list.
Diligence follow-ups
- Confirm a maintainer-transition or key-person plan covering the dominant author (71% of window commits; bus factor 1 on the core module).
- Review the one dependency that is a major version behind its latest release, and the three with upper-bound pins that may block future upgrades.
- Verify CI is enforced on the default branch (workflow files exist; this report does not check branch-protection settings).
- Ask how security reports are triaged and who responds — the commit history cannot answer that.
Every figure above is computed mechanically from the repository's own git history and manifests at report time — no estimate on this page is asserted without its computation shown.