Blog
Deep-dives on engineering analytics, developer productivity, open-source health, and how GitScope is built.
AI + OSV: How GitScope Catches CVEs Before They Hit Production
Static security scanners miss context. GitScope's two-layer approach combines Google's OSV database for known CVEs with an AI layer that understands your codebase's actual exposure — so you see risk, not just a raw vulnerability list. Here is the architecture behind it.
GitScope Team
April 18, 2026
Stop Opening Dashboards: Bring Your Repo Health Into Slack and Discord
The best alert is the one you actually see. GitScope's Slack and Discord integrations push scan alerts and weekly health…
GitScope Team
April 16, 2026
DORA Metrics in Practice: What They Actually Tell You About Your Team
Deployment frequency and change failure rate are easy to measure — but easy to game. We dig into how GitScope surfaces t…
Mara Ellison
March 28, 2026
Building an Open Source Health Scorecard for Your Dependencies
Not all popular packages are healthy. GitScope's Dependency Radar scores packages on maintenance cadence, bus factor, is…
Jin Park
March 14, 2026
Team Velocity Is Not the Sum of Individual Output
Tracking commit counts per engineer is a trap. Real velocity emerges from handoff latency, review throughput, and unbloc…
Camille Ng
February 22, 2026
How We Score 2 Million npm Packages for Production Readiness
Most dependency scanners only check CVEs. Dependency Radar goes further: download velocity, maintainer bus factor, issue…
Jin Park
February 3, 2026
GitScope Is Now in Public Beta
After six months of private testing with 40 engineering teams, GitScope is opening up. Here is what we built, what we le…
GitScope Team
December 5, 2025