--- title: "git-town trust report" type: "trust-report" slug: "git-town-git-town" canonical_url: "https://www.graphcanon.com/tools/git-town-git-town/trust" computed_at: "2026-07-15T10:48:05.283Z" maintenance_label: "Active" security_status: "findings" --- # git-town trust report _Sourced [trust signals](/glossary/trust-and-signals/trust-signal) from public GitHub metadata and external security intelligence providers. Not a security guarantee._ ## Maintenance - Label: Active (82% recency signal) - Days since last push: 7 - Last release: 2026-06-21T13:19:05Z - Releases (90d): 4 - Methodology: github_public_v1 ## Provenance - GitHub repo id: 19825320 - Not a fork - Owner type: Organization - Computed at: 2026-07-15T10:48:05.283Z - Methodology: github_public_v1 ## Security intelligence - **OSV dependency advisories**: Published findings - Last query: 2026-07-15T10:48:07.480235+00:00 - Evidence: https://osv.dev/ - **deps.dev advisories**: Not queried - Evidence: https://deps.dev/ - **OpenSSF Scorecard**: Not queried - Evidence: https://api.securityscorecards.dev/projects/github.com/git-town/git-town - Note: Weekly public scans omit some checks at scale. ### Findings - **low**: GHSA-q6x5-8v7m-xcrf (@protobufjs/utf8@1.1.0 · package-lock.json · osv@v1) - **low**: GHSA-f886-m6hf-6m8v (brace-expansion@1.1.12 · package-lock.json · osv@v1) - **low**: GHSA-22p9-wv53-3rq4 (linkify-it@5.0.0 · package-lock.json · osv@v1) - **low**: GHSA-f23m-r3pf-42rh (lodash@4.17.21 · package-lock.json · osv@v1) - **low**: GHSA-r5fr-rjxr-66jc (lodash@4.17.21 · package-lock.json · osv@v1) - **low**: GHSA-xxjr-mmjv-4gpg (lodash@4.17.21 · package-lock.json · osv@v1) - **low**: GHSA-38c4-r59v-3vqw (markdown-it@14.1.0 · package-lock.json · osv@v1) - **low**: GHSA-6v5v-wf23-fmfq (markdown-it@14.1.0 · package-lock.json · osv@v1) - **low**: GHSA-23c5-xmqv-rm74 (minimatch@3.1.2 · package-lock.json · osv@v1) - **low**: GHSA-3ppc-4f35-3m26 (minimatch@3.1.2 · package-lock.json · osv@v1) - **low**: GHSA-7r86-cg39-jmmj (minimatch@3.1.2 · package-lock.json · osv@v1) - **low**: GHSA-3v7f-55p6-f55p (picomatch@2.3.1 · package-lock.json · osv@v1) - **low**: GHSA-c2c7-rcm5-vvqj (picomatch@2.3.1 · package-lock.json · osv@v1) - **low**: GHSA-2pr8-phx7-x9h3 (protobufjs@6.11.4 · package-lock.json · osv@v1) - **low**: GHSA-66ff-xgx4-vchm (protobufjs@6.11.4 · package-lock.json · osv@v1) - **low**: GHSA-685m-2w69-288q (protobufjs@6.11.4 · package-lock.json · osv@v1) - **low**: GHSA-75px-5xx7-5xc7 (protobufjs@6.11.4 · package-lock.json · osv@v1) - **low**: GHSA-f38q-mgvj-vph7 (protobufjs@6.11.4 · package-lock.json · osv@v1) - **low**: GHSA-fx83-v9x8-x52w (protobufjs@6.11.4 · package-lock.json · osv@v1) - **low**: GHSA-jggg-4jg4-v7c6 (protobufjs@6.11.4 · package-lock.json · osv@v1) - **low**: GHSA-jvwf-75h9-cwgg (protobufjs@6.11.4 · package-lock.json · osv@v1) - **low**: GHSA-wcpc-wj8m-hjx6 (protobufjs@6.11.4 · package-lock.json · osv@v1) - **low**: GHSA-xq3m-2v4x-88gg (protobufjs@6.11.4 · package-lock.json · osv@v1) - **low**: GHSA-ph9p-34f9-6g65 (tmp@0.2.5 · package-lock.json · osv@v1) - **low**: GHSA-w5hq-g745-h8pq (uuid@3.4.0 · package-lock.json · osv@v1) ## Method and caveats These are heuristics from public GitHub data and external security intelligence providers, sourced and dated. "No published findings from this source" is not a guarantee of safety. See the full methodology: [/trust-methodology](/trust-methodology.md). ## Common questions ### Is git-town maintained? GraphCanon rates git-town "Active" (82% maintenance signal from public GitHub metadata, computed today). Last push was 7 days ago. 4 GitHub releases in the last 90 days. This is a recency heuristic, not a guarantee the project will stay maintained. ### Is git-town safe to use? Last scanned today (deps profile). Status: 25 low - 25 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. GraphCanon does not certify git-town as safe - review maintenance, provenance, and scan findings on this page before adopting. ### Is git-town a fork? No. git-town is not flagged as a fork in GitHub metadata at the time of the last refresh. ### Does git-town have known security vulnerabilities? Last scanned today (deps profile). Status: 25 low - 25 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. ### How often is the git-town trust report updated? Trust signals refresh on GitHub ingest/refresh cycles and optional dependency/MCP scans. This report was computed today (methodology github_public_v1). ### What does GraphCanon never claim about git-town? We never publish a composite safety grade, pen-test endorsement, or "verified secure" label for git-town. Signals are sourced heuristics with explicit limits - see [trust methodology](/trust-methodology). ### How does GraphCanon assess trust for git-town? Signals are sourced from public GitHub metadata and optional dependency/MCP manifest scans, each tagged with methodology version and computed date. GraphCanon does not publish a composite safety grade. Read [trust methodology](/trust-methodology) for full scope and limits. --- **Machine-readable endpoints** - JSON: [`/api/graphcanon/tools/git-town-git-town/trust`](/api/graphcanon/tools/git-town-git-town/trust) - LLM index: [/llms.txt](/llms.txt) - Full corpus: [/llms-full.txt](/llms-full.txt) _GraphCanon - The knowledge graph for AI development. https://www.graphcanon.com/_