Screen recent repository signals
Use fast mode to compare many dependencies and identify cases that deserve closer structural attention.
AppSec implications
Use structure as a dependency-review layer.
CVEs, advisories, and posture checks remain important, but they do not capture maintainership concentration, knowledge redundancy, contributor continuity, or historical dependency on a narrow contributor base.
A Three-Stage Decision Model
Evaluate confidence and deviation
Read traffic-light output as signal quality and interpretive confidence, not as repository safety.
Escalate sensitive dependencies
Move critical, unusual, or high-impact cases into full-history review before making trust decisions.
What changed
- Recent stylistic regularity is less informative.
- Low recent turnover is not a sufficient indicator of resilience.
- Modern activity can appear more uniform without changing historical structure.
What did not change
- Concentration still matters.
- Redundancy still matters.
- Long-tail participation still matters.
- Project structure remains more explanatory than AI presence alone.
What Structural Review Adds
Maintainer concentration
Structural metrics help identify when responsibility appears concentrated in a narrow contributor base.
Knowledge redundancy
Contributor redundancy and bus factor provide context about how distributed project knowledge appears to be.
Contributor continuity
Historical participation and churn help distinguish durable structure from a favorable recent snapshot.
Guardrail
Biguá Analyzer should not be used as a vulnerability scanner, an absolute risk score, an AI-authorship detector, or a system that labels repositories as safe or unsafe.