Benchmarks the 'Bus Factor' across the top 1,000 GitHub projects and debunking the correlation between repository popularity and maintainer redundancy.
An analysis of the top 1,000 GitHub projects reveals that almost half have a bus factor of two or less, indicating that the departure of just two key individuals would cripple the project. Only 10% of projects maintain a robust bus factor of 6 or higher. Crucially, research shows zero correlation between repository stars (popularity) and the bus factor; high-visibility projects often depend on a tiny core of knowledge owners. Projects written in general-purpose languages like Python, C, and Java generally maintain higher bus factors than web-centric projects (JS, HTML, CSS), while machine learning libraries show the highest human redundancy, often reaching double-digit bus factors due to broad institutional support.
Nearly 50% of top-1,000 GitHub projects have a lifetime bus factor of 2 or less, with no correlation between popularity and contributor diversity.
sudden project collapse or security decay due to the loss of a key knowledge owner
historical contributor diversity is the definitive metric for supply chain continuity, far more predictive than star counts or download volumes.
Almost half of the projects have a bus factor of two or less... only 10% of projects have a bus factor of 6 or higher... no correlation between repo stars and bus factor.
Risk Guard evaluates contributor count but does not perform 'Knowledge Ownership' analysis (e.g., who edited the most lines in each file) to calculate a true Bus Factor.
Risk Guard would be better if it calculated a 'Knowledge Concentration' score based on file-level authorship to detect when a project depends on a single 'Rockstar' maintainer.