Kospex - Git Analytics

About Kospex

Sun, 12 Jul 2026 10:00:00 +1000

Why Kospex exists

Kospex started with a question that kept coming up on security and code reviews: if no one here knows this code, how would we fix it?

Walk into an organisation with a few hundred repositories and you can usually get a vulnerability report within a day. What is much harder to answer is who understands the code well enough to act on it. Which repositories have no active contributors left. Which systems depend on one person who is about to change teams or resign. Which dependencies have drifted so far behind that a “just bump the version” fix turns into weeks of work.

Contact Us

Sun, 12 Jul 2026 10:00:00 +1000

Are security vulnerabilities an indicator of development testing practices?

Mon, 10 Mar 2025 18:34:57 +1100

TLDR: Security vulnerabilities might be an indicator of low automated unit, integration and regression testing capabilities. Finding vulnerabilities is easier than fixing them as bug fixes need to be tested. Identifying libraries that are getting behind in versions is one indicator of code repository health.

When I first meet a development team, I like to ask three questions to gain an understanding of where they are at:

How often do you release? (e.g. daily, weekly, monthly, quarterly, on demand or adhoc)
How often can you release? (e.g. they can release quickly but don’t)
How much manual testing is required per release?

While answers can be subjective, when there is a higher manual testing and a longer release cycle it more likely it’s going to be harder (or more intensive) to test security fixes and their impacts.

What are orphaned repos and why should you care

Mon, 10 Mar 2025 17:50:26 +1100

TLDR: If no one knows the code, how will you fix or redeploy it? Knowledge of code is important to maintain, operate and make bug or security fixes. However, removing unused repos might improve focus by removing clutter.

In the book, The Mythical Man-Month by Fred Brooks, it talks about disproportionate amount of time developers spend thinking compared to coding. Some say that that source code is only 30% of the development process, with thinking, discussions and discovery being the other 70%. So even if we’ve got the code, we’re missing the thinking which is still in the developers head. Even documentation might not do justice to that days or weeks of thinking and discussions which occurred.