How the code data is measured

This page covers the code-derived figures on the analytics pages — AI-assistant adoption, SBOMs, and dependencies. It is written for a reader who wants to check the numbers rather than take them. The corpus is 637 mirrored open-source repositories, refreshed daily.

## HOW AI AUTHORSHIP IS MEASURED

Two independent tiers. They are defined separately, reported separately, and never merged into a single score.

## WHY BOTH NUMBERS ARE FLOORS

The two tiers identify substantially different populations. Across the 637 repositories:

Both numbers undercount. 137 projects here have AI-authored commits but no assistant config file; 19 have the file but no attributed commits. Only 169 have both — neither signal is a superset of the other, so the real figure is above 51.0%.

A project can use an assistant without ever committing a config file, and can commit a config file while its AI commits are squashed into unattributed merges. The disagreement between the tiers is the strongest evidence available that 51.0% is a floor, so it is published rather than smoothed over.

## WHAT WE DELIBERATELY DO NOT COUNT

• Rewritten history. Squash-merges and rebases strip Co-authored-by: trailers. Work that was genuinely AI-assisted disappears from the record, and there is no way to recover it after the fact.
• Prose mentions. A mention of a tool is not authorship by that tool. A commit reading docs: add CLAUDE.md is a human documenting a file, and is not counted.
• Vendor employees. Matching a whole corporate domain would have counted an assistant company's own staff as machine authors. Xingyao Wang committing from @all-hands.dev and Paul Gauthier from @aider.chat are both humans, and both maintainers of the very tools in question. They are excluded.

Publishing a maintainer's hand-written code as machine-generated is the worst mistake this system could make. The matcher is deliberately biased toward missing AI rather than inventing it.

## WHAT IS NOT CLAIMED

These are repository counts, not proportions of code. A repository with one attributed commit and a repository written mostly by an assistant both count once.

No stylometric or "does this look AI-written" detection is used or endorsed. There is no reliable classifier for AI-authored code, and this project does not pretend otherwise. Every figure above rests on evidence a tool left behind on purpose.

## HOW SBOMS AND DEPENDENCIES ARE MEASURED

Two methods, kept separate because they answer different questions. syft produces the standards-compliant transitive closure — everything a build actually pulls in. Manifest parsing produces direct dependencies — what a project chose to depend on. Collapsing them would be misleading: Trivy's go.sum alone yields roughly 1,200 components.

Test-fixture manifests are excluded. Trivy went from 137 detected manifests to 1 once fixtures were filtered out, and in a corpus of security scanners those fixtures are frequently deliberately vulnerable — counting them would describe the test suite, not the tool.

Dependency licences are the licences of dependencies, not of the tools themselves. And 89.9% of components carry no licence metadata at all — 304,091 of 338,425. That gap is published rather than hidden, because any licence breakdown drawn from the remaining 10.1% has to be read with it in view.

## HOW PROGRAMMING LANGUAGE IS DETERMINED

A tool's primary language is the one holding the most bytes in its current source tree, measured from git's own record of blob sizes. No file's contents are read — a necessary property in a corpus that includes malware-analysis tools shipping live samples. Vendored dependencies, tests and docs are excluded, because they describe someone else's language choice rather than the tool's. Measured against 28 tools whose own project pages name their language, 25 are correct (89%); every miss is C versus C++, the pair that shares the .h extension and vendors most heavily.

The adoption chart places each tool at its earliest commit, so it reads as when the tools we track were started — not as language popularity. This corpus contains tools that survived to be worth tracking in 2026; anything abandoned before then was never added, so every language's early years are understated by an amount nobody can measure. A rewritten tool counts under its current language at its original founding date, which is why a project started in 1993 can appear on a curve for a language that did not yet exist.

4 of 637 repositories ship no source in an extension this analysis names. They stay in the total and appear on no curve — analysed and found nothing, which is a different statement from not analysed.

## HOW HIRING SIGNALS ARE CLASSIFIED

The hiring charts read each vendor's own public job board — the same endpoint their careers page calls. Every open role is placed on three axes, and the rules are published here so any count on that page can be re-derived rather than taken on trust.

Function — one of engineering, product, sales, marketing, support, ga, or other, from keyword rules over the job title, falling back to the department. The rules are tried most-specific first, which is load-bearing: “Technical Support Engineer” and “Sales Engineer” both contain engineer, and testing the narrower function first is what keeps them out of the engineering count. About 6% of real roles carry a title no rule places, and are counted as other.

Region — one of north-america, europe, apac, latam, emea-other, remote, or unknown, by normalising the location string. A location naming no place resolves to remote where it says so and unknown otherwise; roughly 8% land in unknown.

Product area — one of detection, identity, cloud, appsec, data-ai, grc, network, endpoint, or other. Keyword rules run first; the titles they cannot place are put to a model against that closed list, and anything it answers outside the list becomes other rather than a new axis. Only about 18% of open roles name a product area specifically enough to place — most job titles at a security company are generic engineering or go-to-market roles that say nothing about product direction. We count those as other rather than guessing, which is why that chart is graded “don't trust yet”.

What is stored. Role title, location, department, and the dates we first and last saw the posting. Nothing else. Job postings sometimes name a recruiter or hiring manager; there is no field for a person's name and none is ever published. Posting body text is used for classification and discarded, never archived.

What a gap means. A week when a vendor's board could not be fetched is recorded as a failed run and the previous count is carried forward — never counted as zero, because a timeout must not render as a hiring freeze. Likewise, months before we began watching a vendor are left off the chart entirely rather than drawn as zero.

## HOW SEC FINANCIALS ARE MEASURED

The financial charts read the publicly traded vendors' own regulatory filings — the SEC EDGAR companyfacts XBRL API, not a press release or a company's own investor deck. Every figure is as filed: when a company restates a prior period, the restated value replaces the original rather than the two being averaged or both being kept, so a chart can move without any new quarter having happened.

The universe spans five different fiscal year ends — Jan 31, Mar 28, Jul 31, Sep 30, and Dec 31 — so comparing companies by "the quarter their filing labels it" would put, for example, a January filer's quarter a full three months out of step with a December filer's. Every period is instead assigned to the nearest calendar-quarter end, the same calendarisation commercial data providers use, and the only mapping under which these companies land on a shared timeline at all.

SEC filings contain no fourth quarter as a filed number: a company files a 10-Q for Q1, Q2, and Q3, then a 10-K for the full year, and never a three-month Q4 report. Q4 is derived — the fiscal year total minus the three quarters that were filed inside it — and only computed when exactly three quarters are present for that year; two or four means the arithmetic isn't a single missing quarter, and that period is left as a gap rather than guessed at.

Check Point and CyberArk file as foreign private issuers, which are exempt from quarterly reporting in the US — they file annually, not on the 10-Q cadence the rest of the universe does. Their series on the revenue chart is drawn at annual points and labelled with that cadence rather than interpolated into quarters that were never filed.

Tag resolution. "Revenue" is not one XBRL tag — companies file the same accounting concept under different tags, so each metric resolves a short fallback chain and takes the first tag with a value for that exact period. CrowdStrike, for one, tags revenue only as RevenueFromContractWithCustomerIncludingAssessedTax, never the ...Excluding... variant most peers use; Palo Alto and Fortinet tag capital expenditure only as PaymentsToAcquireProductiveAssets, never the ...PropertyPlantAndEquipment tag. Every resolved value carries the specific tag and filing accession it came from, so any number on the page can be traced back to the line item that produced it.

## PROVENANCE

Every figure carries the head_sha it was computed from. Artifacts are published to a content-addressed store, keyed by a digest of the data itself, so any published number can be re-derived or disputed against the exact tree it came from.

Scope: 637 mirrored open-source repositories. The toolchain's other ~182 sources are commercial or documentation-only — they have no repository to inspect, so they are excluded from these denominators rather than counted as non-adopters.