DevLens

Repo health scoring in 9 dimensions + real cybersecurity vulnerability scanning. Free forever, live from the GitHub API.

🌐 Live Dashboard · 🔐 Security Scanner · 📖 Docs · 📊 Stats · 💛 Sponsor

✨ What DevLens Does

🔐 Security Intelligence Engine — 13 Free Scan Modules

Module Source Auth Needed
──────────────────────────────────────────────────────────────────────────
1. Dependabot CVEs github.com API GITHUB_TOKEN
2. Secret Scanning github.com API GITHUB_TOKEN
3. Code Scanning (SAST) github.com API (CodeQL) GITHUB_TOKEN
4. OSV.dev api.osv.dev None (free)
5. NIST NVD services.nvd.nist.gov Optional key (free)
6. GitHub Advisory DB api.github.com GraphQL GITHUB_TOKEN
7. PyPI Safety DB osv.dev ×ばつ requirements.txt None (free)
8. Retire.js CDN Check osv.dev ×ばつ HTML script src None (free)
9. License Risk github.com API GITHUB_TOKEN
10. CI Check Runs github.com API GITHUB_TOKEN
11. SonarCloud sonarcloud.io API None (public repos)
12. DeepSource api.deepsource.io GraphQL None (public repos)
13. Codecov codecov.io API None (public repos)

Security Score Formula (0–100)

Security API

# Full security scan (cached 15 min)
GET https://devlens-io.vercel.app/api/security?repo=owner/name
# Force fresh scan (bypass cache)
GET https://devlens-io.vercel.app/api/security?repo=owner/name&force=1

📊 The 9 Health Dimensions

Dimension Default Weight What it measures
────────────────────────────────────────────────────────────────────
README Quality 20% Length, keywords, code blocks, images, headings
Commit Activity 20% Commits to default branch in last 90 days
Repo Freshness 15% Days since last push (≤7 days = 100)
Documentation 15% LICENSE, CONTRIBUTING, CHANGELOG, SECURITY, docs/
CI/CD Setup 10% GitHub Actions workflow count
Issue Response 10% Closed-to-total issue ratio
Community Signal 5% Logarithmic score from stars + forks
PR Velocity 3% Average PR merge time (last 20 merged PRs)
Security 2% Now powered by the full 13-module scanner

🌐 Dashboard Pages

🚀 Quick Start — Add Badge to Your README

Option A — Static badge

[![DevLens Health](https://devlens-io.vercel.app/api/badge?repo=owner/name)](https://devlens-io.vercel.app/?repo=owner/name)

Option B — Auto-updating via GitHub Actions

<!-- DEVLENS:START -->
<!-- DEVLENS:END -->

name: DevLens Health Check
on:
 push:
 branches: [main]
 schedule:
 - cron: '0 9 * * 1' # every Monday 09:00 UTC
permissions:
 contents: write
jobs:
 devlens:
 runs-on: ubuntu-latest
 steps:
 - uses: actions/checkout@v4
 - name: Fetch DevLens score
 run: |
 curl -s "https://devlens-io.vercel.app/api/analyze?repo=${{ github.repository }}" \
 | jq '.healthScore'

🔌 API Reference

# Analyze a repo
GET https://devlens-io.vercel.app/api/analyze?repo=owner/name
# Full security + vulnerability scan
GET https://devlens-io.vercel.app/api/security?repo=owner/name
GET https://devlens-io.vercel.app/api/security?repo=owner/name&force=1 # bypass cache
# Compare two repos
GET https://devlens-io.vercel.app/api/compare?a=owner/a&b=owner/b
# Score history (last 12 weekly snapshots)
GET https://devlens-io.vercel.app/api/history?repo=owner/name
# Recently checked repos
GET https://devlens-io.vercel.app/api/watchlist
# Badge data
GET https://devlens-io.vercel.app/api/badge?repo=owner/name
# Live usage stats
GET https://devlens-io.vercel.app/api/stats

🛠️ Self-Hosting

git clone https://github.com/SamoTech/devlens
cd devlens/dashboard
npm install
cp .env.example .env.local # fill in env vars
npm run dev # → http://localhost:3000

# GitHub OAuth (Sign in with GitHub)
AUTH_GITHUB_ID=
AUTH_GITHUB_SECRET=
AUTH_SECRET=
# Upstash Redis (watchlist, history, stats, cache)
UPSTASH_REDIS_REST_URL=
UPSTASH_REDIS_REST_TOKEN=
# Server-side GitHub token (60 → 5000 req/hr)
# Powers 9 of the 13 security scan modules
GITHUB_TOKEN=
# NIST NVD API key — free, raises rate limit ×ばつ
# Register at: https://nvd.nist.gov/developers/request-an-api-key
NVD_API_KEY= # optional but recommended

vercel --cwd dashboard
# Set Root Directory = dashboard in Vercel project settings

🗺️ Roadmap

💛 Sponsor

🤝 Contributing

📄 License