expressjs/express audit

Delivery risk audit on GitHub · Analysed 15 Jul 2026 · GitHub

This delivery risk audit analyses the last 90 days of public commit history for expressjs/express. It identifies files that concentrate bug-fix activity, measures revert frequency as a signal of release instability, and maps contributor spread to highlight knowledge concentration risk. The risk score weights bug-fix commits and reverts for each file, with higher scores indicating files that have required the most corrective attention in the analysed period.

Top Risk Files

File	Risk	Bug Commits	Reverts	Commit touches
History.md	35	2	1	—
lib/response.js	25	1	1	—
test/res.send.js	25	1	1	—
.github/workflows/ci.yml	20	2	0	—
.github/workflows/legacy.yml	20	2	0	—
.github/workflows/scorecard.yml	20	2	0	—
.github/workflows/codeql.yml	10	1	0	—
lib/application.js	10	1	0	—
lib/request.js	10	1	0	—
.editorconfig	0	0	0	—
.eslintignore	0	0	0	—
.eslintrc.yml	0	0	0	—
.github/dependabot.yml	0	0	0	—
.gitignore	0	0	0	—
.npmrc	0	0	0	—
examples/auth/index.js	0	0	0	—
examples/auth/views/foot.ejs	0	0	0	—
examples/auth/views/head.ejs	0	0	0	—
examples/auth/views/login.ejs	0	0	0	—
examples/content-negotiation/db.js	0	0	0	—

Other audited repositories

• facebook/react
• LiberoNuvola/PRE-RICH-scratch-and-win-game
• kubernetes/kubernetes
• denoland/deno
• opentofu/opentofu
• apache/kafka
• cilium/cilium
• helm/helm
• argoproj/argo-workflows
• istio/istio
• ansible/ansible
• prometheus/prometheus

All audited repositories →