Review economics
aquasecurity/trivy
Read from the 100 most recently merged pull requests ·
Pull requests with attributed agent authorship took 1.7× the reviews submitted of the rest.
≥4%
Attributed
a floor
4
Attributed PRs
96
Other PRs
100
Read
Attributed — the latest 4
#11019 fix(terraform): avoid panic when for_each local has unknown object values
1 reviews · 5.2d to merge
#10911 feat(seal): detect no-prefix packages by version suffix
17 reviews · 5.1d to merge
#10805 fix: correct format verbs in diagnostic messages
5 reviews · 10.1d to merge
#10776 docs: fix broken nixpkgs reference link in installation guide
1 reviews · 24h to merge
The rest — the latest 5
#11028 chore(deps): bump the github-actions group across 2 directories with 15 updates
1 reviews · 2.8d to merge
#11032 ci(spdx): migrate to Slack notifications
1 reviews · 5h to merge
#11034 ci(helm): bump Trivy version to 0.73.0 for Trivy Helm Chart 0.25.0
1 reviews · 1h to merge
#11012 release: v0.73.0 [main]
2 reviews · 5.3d to merge
#10984 docs: clarify debug logs when version check or telemetry is disabled
2 reviews · 11.9d to merge
How this was measured
4% of merged commits carry agent attribution — a floor, not the share; tools that only complete code inline leave no commit trail, so the unattributed side includes AI-assisted work; 3 PRs came off an agent branch with no commit attribution, so the real share runs higher; reads 100 of 3690 merged PRs — the rest have not been analyzed yet.
Detected: Cursor agent, Claude Code, OpenAI Codex.
“Attributed” means a commit carried an agent’s signature — a co-author trailer, an agent commit identity, or an agent bot account. Tools that only complete code inline leave no such mark, so the other column is “rest”, not “human-written”. Full method and its limits
The badge reads this repo’s current report, so it follows the number.
Tell me when this moves
We re-read aquasecurity/trivy weekly and email only when the number changes materially.
Read your own repos
This one is public. For a private repo, run the same read locally through your own GitHub credentials — nothing is installed and nothing is sent to us.
npx @ambera/review-taxWant this continuously on aquasecurity/trivy — each pull request paired to the task it came from, and the work graded from its review loop rather than its diff size? Claim this repo in Forge
Browse every repo people have read · Read a different repository