What this list is not. A private repository is a legitimate
choice, and this site cannot tell one from an empty one. Nor does it follow
GitLab, Codeberg or self-hosted forges. Rows marked
checked by hand had their own website read for a repository link,
and any plausibly matching GitHub owner checked for a link back to that
website — both directions, or it did not count. The verdicts and
every rejected candidate are committed to
data/audit.json, the same way RealFloat commits its
classification, so the calls can be argued with rather than taken on trust.
Two tokens whose sites would not load are excluded from the percentages
entirely rather than counted as empty.