better-auth/better-auth: Healthy

Decision in one minute

better-auth/better-auth has a verdict of Healthy based on strong adoption, rapid release cadence, and the fact that none of the 22 known vulnerabilities for better-auth (npm) affect the latest version (1.7.11). However, there are potential concerns regarding 31 GitHub security advisories published in the last 365 days and maintainers responding to only 23 percent of sampled items.

Strengths

None of the 22 known vulnerabilities for better-auth (npm) affect the latest version (1.7.11).
Source: None of the 22 known vulnerabilities for better-auth (npm) affect the latest version (1.7.11).
171 releases in the last 365 days.
Source: 171 releases in the last 365 days.
7,564,727 downloads last week on npm.
Source: 7,564,727 downloads last week on npm.

Concerns

31 GitHub security advisories published in the last 365 days.
Source: 31 GitHub security advisories published in the last 365 days.
Maintainers responded to 23 percent of sampled items.
Source: Maintainers responded to 23 percent of sampled items.

Verify before adopting

Review the 31 GitHub security advisories published in the last 365 days to evaluate recurring vulnerability patterns.Source: 31 GitHub security advisories published in the last 365 days.
Investigate maintainer responsiveness to assess if the 23 percent response rate affects critical bug fixes or issue resolution.Source: Maintainers responded to 23 percent of sampled items.
Check missing OpenSSF Scorecard security data to evaluate automated repository security practices.

Uncertainty: Responsiveness metrics were derived from a sample of 12 issues and 50 pull requests from the last 90 days, and OpenSSF Scorecard data was missing.

Written by Gemini Flash from the metrics and reasons below; every number was checked against the data, and the verdict and score come from fixed rules, not the model.

Explained

Why this verdict

2 concerns5 neutral11 positive

Score 87 from 80% of the weight; no hard gates applied.

Concern31 GitHub security advisories published in the last 365 days.
ConcernMaintainers responded to 23 percent of sampled items.
NeutralAt least 1,000 commits in the last 365 days (count capped).
Neutral16 vulnerabilities for better-auth (npm) published in the last 365 days.
NeutralMedian gap between releases over the last 2 years: 0 days.
NeutralGitHub community profile is 75 percent complete (informational).
Neutral30,362 GitHub stars (a weak signal on its own).
PositiveLast commit to the default branch was 0 days ago.
PositiveNone of the 22 known vulnerabilities for better-auth (npm) affect the latest version (1.7.11).
PositiveLast release was 0 days ago (v1.7.11).
Positive171 releases in the last 365 days.
PositiveMedian time to a first response from someone other than the author: 31 hours (sample of 12 issues and 50 pull requests from the last 90 days).
Positive168 people committed in the last 365 days.
PositiveThe most active contributor authored 33 percent of commits in the last 365 days.
PositiveLicensed under MIT (OSI-approved).
PositivePublishes a security policy for reporting vulnerabilities.
PositiveChecks on the default branch are passing.
Positive7,564,727 downloads last week on npm.

Breakdown

Nine dimensions

Security posture
Weight 20
—No data
Insufficient data: No OpenSSF Scorecard data for this repository
Source values
OpenSSF Scorecard
Not availableNo Scorecard data for this repositoryOpenSSF Scorecard API · 19 Oct 2026, 05:15 UTC
Scorecard date
Not availablenot availableOpenSSF Scorecard API · 19 Oct 2026, 05:15 UTC
Advisories (365 days)
31GET /repos/{o}/{r}/security-advisories · 19 Oct 2026, 05:15 UTC
Known vulnerabilities
Weight 15
60Watch
Source values
Package
npm: better-authEntered in admin
Latest version
1.7.11registry.npmjs.org · 19 Oct 2026, 05:15 UTC
Known vulnerabilities (all versions)
22OSV.dev POST /v1/query · 19 Oct 2026, 05:15 UTC
With a fixed version
22OSV.dev POST /v1/query · 19 Oct 2026, 05:15 UTC
Affecting the latest version
0queried with 1.7.11OSV.dev POST /v1/query · 19 Oct 2026, 05:15 UTC
Published in last 365 days
16OSV.dev POST /v1/query · 19 Oct 2026, 05:15 UTC
Most recent published
2026-07-24OSV.dev POST /v1/query · 19 Oct 2026, 05:15 UTC
Maintenance
Weight 15
100Healthy
Source values
Archived
NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:15 UTC
Disabled
NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:15 UTC
Days since last default-branch commit
0 daysGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:15 UTC
Commits in last 365 days
≥ 1,000cappedGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:15 UTC
Release cadence
Weight 10
100Healthy
Source values
Days since last release
0 daysGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:15 UTC
Releases in last 365 days
171GET /repos/{o}/{r}/releases · 19 Oct 2026, 05:15 UTC
Median days between releases (2 years)
0 daysover the last 2 yearsGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:15 UTC
Uses GitHub Releases
YesGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:15 UTC
Latest release
v1.7.11GET /repos/{o}/{r}/releases · 19 Oct 2026, 05:15 UTC
Responsiveness
Weight 10
54Watch
sampled (62 items)
Source values
Issues sampled
12issues updated in the last 90 days, PRs excluded, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:15 UTC
Pull requests sampled
50pull requests updated in the last 90 days, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:15 UTC
Median time to first response
30.7 hourssampledGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:15 UTC
Share with a maintainer response
23%sampledGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:15 UTC
Maintainer depth
Weight 10
100Healthy
Source values
Distinct contributors (365 days)
168from the most recent 1,000 commitsGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:15 UTC
Top contributor's share of commits
33%GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:15 UTC
Top contributor
bytaesuGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:15 UTC
Low bus factor
NoGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:15 UTC
Governance and licensing
Weight 10
100Healthy
Source values
License (SPDX)
MITGET /repos/{owner}/{repo} · 19 Oct 2026, 05:15 UTC
License status
OSI-approvedGET /repos/{owner}/{repo} + OSI list · 19 Oct 2026, 05:15 UTC
Security policy
YesGET /repos/{o}/{r}/contents/SECURITY.md · 19 Oct 2026, 05:15 UTC
Code of conduct (info)
YesGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:15 UTC
Contributing guide (info)
YesGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:15 UTC
Issue templates (info)
NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:15 UTC
Community profile (info)
75%GET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:15 UTC
CI health
Weight 5
100Healthy
Source values
Default-branch checks
PassingGET /repos/{o}/{r}/commits/{sha}/check-runs · 19 Oct 2026, 05:15 UTC
Method
check-runsGitHub · 19 Oct 2026, 05:15 UTC
Adoption
Weight 5
100Healthy
Source values
Weekly downloads
7,564,727npm (last 7 days) · 19 Oct 2026, 05:15 UTC
Stars (weak signal)
30,362GET /repos/{owner}/{repo} · 19 Oct 2026, 05:15 UTC
Forks (weak signal)
2,989GET /repos/{owner}/{repo} · 19 Oct 2026, 05:15 UTC
Dependents
Not availableNot collected: no reliable public source without scraping— · 19 Oct 2026, 05:15 UTC

Over time

Trend

Score moved from 84 to 87; the verdict stayed Healthy.
Responsiveness improved from Risky to Watch on the last refresh.

2026-W42 HealthyScore 8480% coverage
2026-W43 HealthyScore 8780% coverageShown above

History

Decision log

No decision recorded yet. Status: Evaluating.

Why this verdict

2 concerns5 neutral11 positive

Score 87 from 80% of the weight; no hard gates applied.

Concern31 GitHub security advisories published in the last 365 days.

ConcernMaintainers responded to 23 percent of sampled items.

NeutralAt least 1,000 commits in the last 365 days (count capped).

Neutral16 vulnerabilities for better-auth (npm) published in the last 365 days.

NeutralMedian gap between releases over the last 2 years: 0 days.

NeutralGitHub community profile is 75 percent complete (informational).

Neutral30,362 GitHub stars (a weak signal on its own).

PositiveLast commit to the default branch was 0 days ago.

PositiveNone of the 22 known vulnerabilities for better-auth (npm) affect the latest version (1.7.11).

PositiveLast release was 0 days ago (v1.7.11).

Positive171 releases in the last 365 days.

PositiveMedian time to a first response from someone other than the author: 31 hours (sample of 12 issues and 50 pull requests from the last 90 days).

Positive168 people committed in the last 365 days.

PositiveThe most active contributor authored 33 percent of commits in the last 365 days.

PositiveLicensed under MIT (OSI-approved).

PositivePublishes a security policy for reporting vulnerabilities.

PositiveChecks on the default branch are passing.

Positive7,564,727 downloads last week on npm.

Nine dimensions

Security posture

Weight 20

—No data

Insufficient data: No OpenSSF Scorecard data for this repository

Source values

OpenSSF Scorecard: Not availableNo Scorecard data for this repositoryOpenSSF Scorecard API · 19 Oct 2026, 05:15 UTC
Scorecard date: Not availablenot availableOpenSSF Scorecard API · 19 Oct 2026, 05:15 UTC
Advisories (365 days): 31GET /repos/{o}/{r}/security-advisories · 19 Oct 2026, 05:15 UTC

Known vulnerabilities

Weight 15

60Watch

Source values

Package: npm: better-authEntered in admin
Latest version: 1.7.11registry.npmjs.org · 19 Oct 2026, 05:15 UTC
Known vulnerabilities (all versions): 22OSV.dev POST /v1/query · 19 Oct 2026, 05:15 UTC
With a fixed version: 22OSV.dev POST /v1/query · 19 Oct 2026, 05:15 UTC
Affecting the latest version: 0queried with 1.7.11OSV.dev POST /v1/query · 19 Oct 2026, 05:15 UTC
Published in last 365 days: 16OSV.dev POST /v1/query · 19 Oct 2026, 05:15 UTC
Most recent published: 2026-07-24OSV.dev POST /v1/query · 19 Oct 2026, 05:15 UTC

Maintenance

Weight 15

100Healthy

Source values

Archived: NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:15 UTC
Disabled: NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:15 UTC
Days since last default-branch commit: 0 daysGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:15 UTC
Commits in last 365 days: ≥ 1,000cappedGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:15 UTC

Release cadence

Weight 10

100Healthy

Source values

Days since last release: 0 daysGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:15 UTC
Releases in last 365 days: 171GET /repos/{o}/{r}/releases · 19 Oct 2026, 05:15 UTC
Median days between releases (2 years): 0 daysover the last 2 yearsGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:15 UTC
Uses GitHub Releases: YesGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:15 UTC
Latest release: v1.7.11GET /repos/{o}/{r}/releases · 19 Oct 2026, 05:15 UTC

Responsiveness

Weight 10

54Watch

sampled (62 items)

Source values

Issues sampled: 12issues updated in the last 90 days, PRs excluded, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:15 UTC
Pull requests sampled: 50pull requests updated in the last 90 days, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:15 UTC
Median time to first response: 30.7 hourssampledGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:15 UTC
Share with a maintainer response: 23%sampledGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:15 UTC

Maintainer depth

Weight 10

100Healthy

Source values

Distinct contributors (365 days): 168from the most recent 1,000 commitsGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:15 UTC
Top contributor's share of commits: 33%GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:15 UTC
Top contributor: bytaesuGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:15 UTC
Low bus factor: NoGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:15 UTC

Governance and licensing

Weight 10

100Healthy

Source values

License (SPDX): MITGET /repos/{owner}/{repo} · 19 Oct 2026, 05:15 UTC
License status: OSI-approvedGET /repos/{owner}/{repo} + OSI list · 19 Oct 2026, 05:15 UTC
Security policy: YesGET /repos/{o}/{r}/contents/SECURITY.md · 19 Oct 2026, 05:15 UTC
Code of conduct (info): YesGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:15 UTC
Contributing guide (info): YesGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:15 UTC
Issue templates (info): NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:15 UTC
Community profile (info): 75%GET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:15 UTC

CI health

Weight 5

100Healthy

Source values

Default-branch checks: PassingGET /repos/{o}/{r}/commits/{sha}/check-runs · 19 Oct 2026, 05:15 UTC
Method: check-runsGitHub · 19 Oct 2026, 05:15 UTC

Adoption

Weight 5

100Healthy

Source values

Weekly downloads: 7,564,727npm (last 7 days) · 19 Oct 2026, 05:15 UTC
Stars (weak signal): 30,362GET /repos/{owner}/{repo} · 19 Oct 2026, 05:15 UTC
Forks (weak signal): 2,989GET /repos/{owner}/{repo} · 19 Oct 2026, 05:15 UTC
Dependents: Not availableNot collected: no reliable public source without scraping— · 19 Oct 2026, 05:15 UTC