
Product
Introducing Reachability for PHP
Reachability analysis for PHP is now available in experimental, helping teams identify which vulnerabilities are actually exploitable.
boot-github-spy
Advanced tools
A Node.JS script that runs periodically (cron) and reviews activity of the unwilling participant and publishes the activity/findings to an analytics engine (keen.io).
Review the blog post about the Github Spy.
Sometimes (e.g. running a coding school) you need to track how developers are interacting with GitHub. This simple script/bot reports the last public activities for a user and using Keen.IO you can make decisions of the developer/group.
While at Code RGV, I created GitHub Spy to review our students. We needed to ensure that students are modeling good behavior of software developers. Trust but verify, if you will.
The following developers were randomly picked from the trending projects.

This project stands on the shoulder of giants:
To get started:
git clone https://github.com/ibolmo/github-spy
cd github-spy
npm install
users.js fileUpdate this file to include all the users you'd like to track.
.env fileThe project includes a .env.example file. This file needs to be copied, and updated with the correct values for each environment variable. A .env is used to protect your secret from the public. Learn more in the motdotla/dotenv repository. It's also handy when deploying to OpenShift.
cp .env.example .env
vim .env
npm run spy
Be sure to get a free account at RedHat's OpenShift. Review the OpenShift getting started.
# create sample app on openshift
rhc app create GitHubSpy nodejs-0.10
cd GitHubSpy
git remote show origin # write down the url
# go back to this cloned repo
cd ../github-spy
# update the openshift environment variables
# recommendation: create a .env.prod with new keen.io key
rhc set-env .env.prod -a GitHubSpy
git remote add openshift ssh://...your.url..
git push -f openshift
FAQs
An openshift-ready Github user analytics collector.
We found that boot-github-spy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Reachability analysis for PHP is now available in experimental, helping teams identify which vulnerabilities are actually exploitable.

Product
Export Socket alert data to your own cloud storage in JSON, CSV, or Parquet, with flexible snapshot or incremental delivery.

Research
/Security News
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.