OWASP/cornucopia - Open Source PR Review Scorecard

The source files and tools needed to build the OWASP Cornucopia decks in various languages

C-Rank Grade: A (Welcoming) - 70/100

External PR Merge Rate: 81%

Response Time: 2d

First Timer Success: 71%

Frequently Asked Questions

Is OWASP/cornucopia welcoming to first-time open-source contributors?

OWASP/cornucopia has a recorded first-timer success rate of 70.6%. Repositories ranked A typically provide actionable feedback during code reviews and actively nurture new community contributors.

How fast can I expect code review feedback on my pull request?

Maintainers in OWASP/cornucopia respond to incoming external pull requests in approximately 55.6 hours on average. Keeping PRs focused on single tasks and ensuring tests pass helps maintainers review faster.

What does the 70.0 C-Rank™ score (A Tier) represent?

The C-Rank™ system evaluates GitHub projects on a 0–100 scale using real data: PR merge rates, review turnaround time, active maintainer presence, and first-time contributor success. A score of 70.0 places OWASP/cornucopia in the A tier.

What is the external contributor pull request merge rate for OWASP/cornucopia?

The external contributor pull request merge rate for OWASP/cornucopia is 80.6%, based on public PR activity from non-core contributors.

Are there Good First Issues available in OWASP/cornucopia?

OWASP/cornucopia currently has 11 active issue(s) tagged with beginner-friendly labels like "good first issue", "beginner", or "up-for-grabs".

OWASP
OWASP/cornucopiaA•Welcoming145
GitHub
Back to Explorer
OWASP

OWASP/cornucopia

145
InactiveA•Welcoming(70/100)Python

The source files and tools needed to build the OWASP Cornucopia decks in various languages

GitHub
Compare••
Jump to:

AI Maintainer Review Guidelines

Review Persona

Welcoming Community Builder

Warmth Score
8.8/10
Patience Score
8.8/10
Nitpick Rate
25%

Highly welcoming maintainers in OWASP/cornucopia. Prompt code reviews with positive guidance for new contributors.

Top PR Submission Do's

  • •Ensure code complies with the project coding style
  • •Keep PRs scoped to a single concern
  • •Include context and link to the related issue

Top PR Friction Pitfalls (Don'ts)

  • •Do not submit PRs without linking an issue
  • •Do not break existing tests without fixing them
  • •Do not mix unrelated refactors in a single PR
Response Velocity
2 days+
Standard maintainer review cycle

Average Response Latency

Tracks hours until a maintainer leaves a review, comment, or PR response.

Merge Efficiency
80.6%
High acceptance rate for external PRs

External Acceptance Rate

Percentage of community pull requests successfully merged into main.

First-Timer Success
70.6%
Strong first-timer PR acceptance rate

First PR Conversion

Rate at which developers submitting their first repository PR succeed.

Active Maintainers
15 core
Highly collaborative maintainer core
Diagnostic Health HUD
80.6%
Merge Gauge
70.6%
1st-Timer
Community Vibe53/100

Embed C-Rank Badge

Show contributors that your repository actively reviews and merges external pull requests.

GetMerged C-Rank badge for OWASP/cornucopia
[![GetMerged C-Rank](https://getmerged.abhishekco.de/api/badge/OWASP/cornucopia)](https://getmerged.abhishekco.de/OWASP/cornucopia?utm_source=github&utm_medium=badge)

Active Good First Issues (5)

View on GitHub

Upgrade @vitest/mocker from 4.1.10 to 5.0

📅 Opened Sep 30, 2026💬 1 comment
Quality: 75/100Contribute

sveltekit-i18n needs to be migrated from 2.4.2 to 3.0.0.

📅 Opened Sep 17, 2026💬 2 comments
Quality: 75/100Contribute

The application should: Validate file paths for null bytes (and other invalid characters) Log a clear error message explaining the invalid input Exit gracefully (with an appropriate exit code) NOT crash with an unhandled ValueError You should create a wrapper for validate_filepath: def validate_filepath_no_nulls(value: str) -> str: """Validate filepath and ensure it contains no null bytes.""" if '\x00' in value: raise argparse.ArgumentTypeError("File path cannot contain null bytes") return validate_filepath_arg(value) Then hook this up during parse_arguments: def parse_arguments(input_args: list[str]) -> argparse.Namespace: """Parse command line arguments.""" parser = argparse.ArgumentParser(description="Enrich CAPEC mappings with names from CAPEC JSON catalog") parser.add_argument( "-c", "--capec-json", type=validate_filepath_no_nulls, # Use custom validator default=EnricherVars.DEFAULT_CAPEC_JSON_PATH, help="

📅 Opened Sep 16, 2026💬 3 comments
Quality: 90/100Contribute

Is your feature request related to a problem? Please describe. Travelling with card decks is always more complicated than it needs to be. The deck always gets a raised eyebrow from airport security given the shape and density. Describe the solution you'd like A pocketable deck sized would be perfect. It would not be in your luggage but in your pocket, easily removed from travel and being in your pocket it would more likely be pulled out and used during your travel as well! Deck dimensions: 3.43 x 1.26 inches (87 x 32mm) Describe alternatives you've considered Phone only version - but that means having connectivity all the time. Additional context The inspiration for this is actually the Air Deck https://onebagtravels.com/air-deck-playing-cards-3-0/

📅 Opened Sep 10, 2026💬 1 comment
Quality: 90/100Contribute

The current config: https://github.com/OWASP/cornucopia/blob/master/cornucopia.owasp.org/decks.yaml should be read in as a config.js file in order to be able to use it from anywhere in svelte. // src/lib/config.js import yaml from 'yaml'; import yamlText from '$lib/../../decks.yaml?raw'; // Export the native object structure export const config = yaml.parse(yamlText); export const decks = config.decks; then it can be read in here: https://github.com/OWASP/cornucopia/blob/55730310ff0f238e541040647ffe630e4d42a923/cornucopia.owasp.org/src/lib/services/deckConfigService.ts#L2 like this: import { deckConfig } from '$lib/config'; or from anywhere in the code where it is needed.

📅 Opened Sep 9, 2026💬 2 comments
Quality: 90/100Contribute
Looking for more Python beginner tasks?Explore Python GFI

Contributor Community Vibe Feedback

Rate what actually matters after opening a pull request here.

Have you contributed to this repo?

Rate your first-hand PR experience (review speed, maintainer responsiveness, and onboarding ease) to help other contributors.

3 ratings required
Maintainer helpfulness
Review speed
Beginner friendliness

Contributor Compatibility & Review Speed Analysis for OWASP/cornucopia

When evaluating whether to contribute to OWASP/cornucopia, response velocity and maintainer engagement are crucial. GetMerged continuously tracks pull request trajectories, first-comment latency, and code review rounds to help developers avoid submitting pull requests to backlogged repositories.

Currently, maintainers of OWASP/cornucopia acknowledge new external contributions in approximately 2 days+. Out of all submitted pull requests from non-core authors in the last 180-day window, 80.6% were successfully merged into the primary branch.

Frequently Asked Questions - Contributing to OWASP/cornucopia

01

Is OWASP/cornucopia welcoming to first-time open-source contributors?

OWASP/cornucopia has a recorded first-timer success rate of 70.6%. Repositories ranked Welcoming typically provide actionable feedback during code reviews and actively nurture new community contributors.

02

How fast can I expect code review feedback on my pull request?

The initial maintainer response time averages ~2 days+. Keeping PRs scoped to single concerns and ensuring CI checks succeed will optimize review turnaround.

03

What does the 70.0 C-Rank™ score represent?

The C-Rank™ index scores repositories on a 0 to 100 scale using an objective formula: external PR merge rates, initial response speed, active maintainer count, and first-time contributor retention. A score of 70.0 places OWASP/cornucopia in the Welcoming tier.

04

What is the external contributor pull request merge rate for OWASP/cornucopia?

The external pull request merge rate is 80.6%. GetMerged isolates non-core community contributions so external developers get an accurate benchmark of PR acceptance probability.

05

Are there beginner Good First Issues open in OWASP/cornucopia?

Yes, OWASP/cornucopia currently has 11 active issue(s) tagged with beginner-friendly labels. You can inspect these directly from the repository issues tab.

GetMerged C-Rank™ Indexing Standard

All metrics displayed for OWASP/cornucopia are automatically retrieved via the public GitHub API and recalculated daily. Insider pull requests submitted by repository owners or organization members are excluded from merge rate calculations to preserve objective external contributor statistics.