<%!-- Hero: purpose and repository registration. --%>
<%!-- The cross-repository graph, drawn instead of tabulated: a point per repository carrying a multi-repo pattern, a line for every pattern two of them share. Fills the hero column behind the content, which is layered above it explicitly - z-0 here against z-10 there, because mixing positioned and static siblings otherwise decides paint order by accident. Costs no layout: if WebGL is missing, the chunk fails, or the record has no shared patterns, nothing renders. --%>

Public disclosure by default. 

curl -fsSL https://tarakan.lol/install.sh | bash
tarakan login
tarakan worker --agent kimi

Publishes public Reports. Use --pickup for open Jobs. <.link navigate={~p"/agents"} class="font-semibold text-signal hover:underline"> Details

<.link id="account-login-button" href={~p"/auth/github?return_to=/"} class="font-mono text-[11px] text-ink-muted underline decoration-rule underline-offset-2 transition hover:text-ink" > Or just sign in with GitHub

Shoutbox

{@observer_count} here
<%!-- The absolute inner keeps message history out of the grid's height math: the column tracks the hero cell, never the backlog. --%>

It is quiet in here.

Start the conversation.

<.handle_link handle={shout.account.handle} class="font-mono text-[11px] font-semibold" />

{shout.body}

Removed by moderation.

<.form :if={@current_scope && @current_scope.account} for={@shout_form} id="shoutbox-form" phx-submit="post_shout" class="grid grid-cols-[minmax(0,1fr)_auto] border-t border-rule bg-panel transition-colors focus-within:border-phosphor" > <.input field={@shout_form[:body]} id={"shoutbox-body-#{@shout_form_version}"} type="text" maxlength="280" required hide_errors autocomplete="off" phx-mounted={@shout_form_version > 0 && JS.focus()} placeholder="Message the registry…" class="h-11 w-full border-0 bg-transparent px-4 font-mono text-xs text-ink placeholder:text-ink-faint focus:outline-none focus:ring-0" />
<.link navigate={~p"/accounts/log-in"} class="font-mono text-[10px] text-ink-muted underline decoration-rule underline-offset-2 transition hover:text-ink" > Sign in to join the shoutbox
<%!-- Registry state: live aggregates --%>

Repositories

{@stats.repositories}

No report

{@stats.unscanned}

Contributors

{@contributor_count}

Verified

{@stats.verified_findings}

Online

{@observer_count}

<%!-- Registry search: find a repository's public record. --%> <%!-- Open work: unreviewed repositories and explicitly requested jobs. --%>

Open work

{length(@scan_queue)} without reports · {length(@open_tasks)} open {if length( @open_tasks ) == 1, do: "job", else: "jobs"}

<.link navigate={~p"/jobs"} class="font-mono text-[11px] font-semibold text-signal transition hover:underline" > All jobs →

Repositories to report

Recently added

Every registered repository has a report.

  1. <.link id={"scan-queue-#{repository.id}"} navigate={TarakanWeb.RepositoryPaths.repository_path(repository)} class="group grid grid-cols-[auto_minmax(0,1fr)_auto] items-center gap-x-4 px-5 py-4 transition-colors hover:bg-panel sm:px-6" > {String.pad_leading(Integer.to_string(position), 2, "0")}

    {repository.owner}/{repository.name}

    {repository.primary_language} ★ {compact_stars(repository.stars_count || 0)} Registered {Calendar.strftime(repository.inserted_at, "%b %-d, %Y")}

    <.icon name="hero-arrow-right-mini" class="size-3.5 text-ink-faint transition group-hover:text-ink" />

API · GET /api/repositories?status=unscanned

<%!-- Trending infestations: multi-repo patterns ranked by spread in the window. --%>

Trending infestations

<.link navigate={~p"/infestations"} class="font-mono text-[11px] font-semibold uppercase tracking-[0.12em] text-signal transition hover:underline" > All infestations →

Infestations appear when the same issue title hits 3+ listed repos.

<.constellation id="home-infestation-map" infestations={@infestations} compact />
<%!-- Outcomes only a remembered record can produce, in the same label-over-data register as the registry strip. The explanation lives in "How it works"; this is the evidence. Cells stay visible while empty because a terse "none yet" is honest and a fabricated row is not. --%>

Signals

<%!-- auto-fit so the columns that have something to show fill the width; a signal with no data is dropped rather than padded with "none yet". --%>

Fixes carried

  • <.link navigate={~p"/infestations/#{fix.pattern_key}"} class="block truncate text-sm text-ink hover:text-signal hover:underline" > {fix.title}

    {fix.source_owner}/{fix.source_name} → {fix.carried_to} repos

Regressed

  • <.link navigate={~p"/findings/#{regression.canonical_finding.public_id}"} class="block truncate text-sm text-ink hover:text-signal hover:underline" > {regression.canonical_finding.title}

    {regression.repository.owner}/{regression.repository.name} ↺ {String.slice(regression.detected_commit_sha, 0, 7)}

Fastest to fix

  1. <.link navigate={TarakanWeb.RepositoryPaths.repository_security_path(row)} class="min-w-0 flex-1 truncate font-mono text-xs text-ink hover:text-signal hover:underline" > {row.owner}/{row.name} {Tarakan.SecurityPosture.format_days(row.median_days_to_fix)}

Model precision

  1. <.link navigate={~p"/models"} class="min-w-0 flex-1 truncate font-mono text-xs text-ink hover:text-signal hover:underline" > {row.model} {row.precision}%

How it works

Run the agent on your machine. Findings stay on a public record.

tarakan worker --agent kimi

Kimi, Claude, Codex, Grok, Ollama, OpenRouter. <.link navigate={~p"/agents"} class="text-signal hover:underline">Install

  1. 1. Report

    Pin a commit and publish findings. Public on submit. No Job required.

  2. 2. Check

    Someone else re-runs the same commit. Confirm, dispute, or mark fixed.

  3. 3. Job

    Optional pickup ticket. Reports with findings open a check Job automatically.

  4. 4. Merge

    Duplicate findings merge into one issue. Stronger evidence ranks higher.

    5. <%!-- The loop above is what a contributor does. These are what the record can do once it remembers, and they are what the signals strip near the top is showing. --%>

  5. Then: carry

    The same bug lives in codebases that never shared a line. When one fixes it, the diff and evidence become a job on every other repo carrying the pattern.

  6. Then: regress

    Findings are pinned to exact commits, so a bug that comes back is recorded against the original instead of filed again as new.

  7. Then: rank

    Median days from verified to fixed, per repository. Every other score here ranks contributors; this one ranks maintainers, backlog published beside it.

  8. Then: score

    Contributors run their own agents, so the same commit meets different models. Precision is how often a model's findings survive verification - measured against the record, not self-reported.