GUAC aggregates software security metadata into a high fidelity graph database.
C-Rank Grade: A (Welcoming) - 66/100
External PR Merge Rate: 63%
Response Time: 14h
First Timer Success: 80%
guacsec/guac has a recorded first-timer success rate of 80.0%. Repositories ranked A typically provide actionable feedback during code reviews and actively nurture new community contributors.
Maintainers in guacsec/guac respond to incoming external pull requests in approximately 14.0 hours on average. Keeping PRs focused on single tasks and ensuring tests pass helps maintainers review faster.
The C-Rank™ system evaluates GitHub projects on a 0–100 scale using real data: PR merge rates, review turnaround time, active maintainer presence, and first-time contributor success. A score of 65.5 places guacsec/guac in the A tier.
The external contributor pull request merge rate for guacsec/guac is 63.0%, based on public PR activity from non-core contributors.
guacsec/guac currently has 2 active issue(s) tagged with beginner-friendly labels like "good first issue", "beginner", or "up-for-grabs".
Active maintainer team in guacsec/guac welcoming community pull requests and bug fixes.
Average Response Latency
Tracks hours until a maintainer leaves a review, comment, or PR response.
External Acceptance Rate
Percentage of community pull requests successfully merged into main.
First PR Conversion
Rate at which developers submitting their first repository PR succeed.
Show contributors that your repository actively reviews and merges external pull requests.
[](https://getmerged.abhishekco.de/guacsec/guac?utm_source=github&utm_medium=badge)
Historical health & responsiveness evolution
External PR acceptance
First PR success rate
50% receive response in
90% receive response in
Maintainer review activity heatmap & prime window prediction
Calculating local time...
Calculating local time...
Detected: UTC
Maintainers are most responsive around 07:00 UTC (07:00 UTC in your timezone). Recommended submission window is Wednesday - Friday from 12:00 to 16:00 UTC (12:00 - 16:00 UTC local).
Maintainer Strategy: Maintainer Sweet Spot: PRs under 150 lines merge in ~9 hours (79% approval). Large PRs (>500 lines) take ~67 hours (28% approval). Keep your diff compact for rapid review.
Currently the lint is checked on the diff in a PR. There are several lint issues currently in the existing codebase which can be fixed in a phased manner. 102 issues: errcheck: 50 staticcheck: 50 unused: 2
Describe the bug This failure in seen in several recent runs of the CI for Integration Tests workflow === Failed === FAIL: pkg/guacanalytics Test_SearchSubgraphFromVuln/Test_case_1:_two_levels_of_dependents,_no_stopID_and_no_limiting_maxDepth_ (0.00s) patchPlanning_test.go:1505: error ingesting test data: error in ingesting package: Post "http://localhost:9090/query": dial tcp [::1]:9090: connect: connection refused === FAIL: pkg/guacanalytics Test_SearchSubgraphFromVuln (0.27s) 2026-03-19T05:53:18.519Z INFO logging/logger.go:79 Logging at debug level {"guac-version": "v0.0.1-custom"} 2026-03-19T05:53:18.519Z DEBUG logging/logger.go:111 InitLogger has not been called. Defaulting to debug log level {"guac-version": "v0.0.1-custom"} 2026-03-19T05:53:18.520Z INFO guacanalytics/patchPlanning_test.go:1679 starting server {"guac-version": "v0.0.1-custom"} here2026-03-19T05:53:18.792Z INFO guacanalytics/patchPlanning_test.go:1682 server finished: http: Server closed {"guac-version": "v0.
Is your feature request related to a problem? Please describe. Currently, the project does not include fuzz tests. This means certain classes of bugs—such as unexpected input handling issues, parsing errors, or edge-case crashes—may go undetected during regular unit or integration testing. OpenSSF scorecard also flags this currently. Describe the solution you'd like Introduce fuzz testing for components that process external or complex inputs (e.g., parsers, input validation logic, and serialization/deserialization paths). Modern fuzzing approaches such as coverage-guided fuzzing (e.g., Go’s native fuzzing support) can help automatically generate diverse inputs and uncover hidden edge cases. Best practices could include: Starting with fuzz tests for critical input-handling functions. Using Go’s built-in fuzzing framework (go test -fuzz) for easy integration. Running fuzz tests periodically in CI or as part of security testing workflows. Describe alternatives you've considered
Rate what actually matters after opening a pull request here.
Rate your first-hand PR experience (review speed, maintainer responsiveness, and onboarding ease) to help other contributors.
When evaluating whether to contribute to guacsec/guac, response velocity and maintainer engagement are crucial. GetMerged continuously tracks pull request trajectories, first-comment latency, and code review rounds to help developers avoid submitting pull requests to backlogged repositories.
Currently, maintainers of guacsec/guac acknowledge new external contributions in approximately 13 hours. Out of all submitted pull requests from non-core authors in the last 180-day window, 63.0% were successfully merged into the primary branch.
guacsec/guac has a recorded first-timer success rate of 80.0%. Repositories ranked Welcoming typically provide actionable feedback during code reviews and actively nurture new community contributors.
The initial maintainer response time averages ~13 hours. Keeping PRs scoped to single concerns and ensuring CI checks succeed will optimize review turnaround.
The C-Rank™ index scores repositories on a 0 to 100 scale using an objective formula: external PR merge rates, initial response speed, active maintainer count, and first-time contributor retention. A score of 65.5 places guacsec/guac in the Welcoming tier.
The external pull request merge rate is 63.0%. GetMerged isolates non-core community contributions so external developers get an accurate benchmark of PR acceptance probability.
Yes, guacsec/guac currently has 2 active issue(s) tagged with beginner-friendly labels. You can inspect these directly from the repository issues tab.
All metrics displayed for guacsec/guac are automatically retrieved via the public GitHub API and recalculated daily. Insider pull requests submitted by repository owners or organization members are excluded from merge rate calculations to preserve objective external contributor statistics.