Reporting an Entry

Spotted spam on the list, a repo that's turned nasty, or one that died months ago? Tell me. It takes about 30 seconds. The bot closes the reports it can't use, and I read the ones that make it through.

File a report

1. Open the Report an entry form.
2. Entry: the listed repo, as a GitHub link or owner/name.
3. Reason: pick the one that fits. They're explained below.
4. Replaced by: only for "Replaced by something better". Give the replacement as owner/name.
5. Details: anything that helps me check, such as a link to the malicious file or the issue where the maintainer said they'd stopped. A few sentences is plenty.
6. Select Submit new issue.

Please don't edit the report after you've filed it. An edited report no longer counts toward hiding an entry, because what it says may not be what the bot read.

The reasons

Reason	Use it for
Spam or SEO	A repo that exists to advertise something, game search results, or pad someone's profile
Malicious (malware, phishing, stolen code)	Anything that harms the people who install or visit it
Dead or abandoned	A repo that has stopped working, or that its maintainer has walked away from
Replaced by something better	A repo that a fork or successor has taken over from
Wrong category	A repo filed in a category that doesn't fit. Tell me the right one in Details.
Something else	Anything that doesn't fit the above

What the bot does with it

The bot usually replies shortly. It closes a report itself if the form is incomplete, the repo isn't on the list, or it's your sixth report in 24 hours. Every other report gets the needs-review label, and that's the queue I read from. Issues the bot files itself are separate. Some reasons also trigger something straight away:

Reason	What happens now
Malicious	If you have an established account, the entry is hidden at once while I review it. Otherwise it's queued.
Spam or SEO	Once 3 different established accounts have open spam reports on the same entry, it's hidden while I review it. Until then, each report is queued. Malicious reports are handled separately, as above.
Dead or abandoned	The bot runs the health check on that repo straight away, instead of waiting for Monday. If it was checked in the last day, or a lot of checks are already queued, I take it instead. A failing check starts the usual removal notice; it doesn't take the entry off on the spot.
Replaced by something better	Labelled superseded and queued. I compare the two and decide what stays listed.
Wrong category	Queued for me.
Something else	Queued for me. These never hide an entry on their own.

Spam reports older than 30 days don't count toward a hide.

Hidden means off the list, not deleted. If the review finds nothing wrong, I put it back, and the reports from before that don't count toward hiding it again.

I make the final call on every reported entry that reaches review. The replacement in a "Replaced by" report is only listed if it passes the Quality Bar like any other repo.

When a report isn't acted on automatically

These still get needs-review, but the bot doesn't hide anything or count them toward a hide:

• Your account doesn't pass the trust rule. The report waits for me to read it.
• Your account isn't established yet. A malicious or spam report is queued, but it can't hide an entry.
• The entry is already hidden. Your report joins the review that's already open.

And these are closed straight away:

• You've filed 5 reports in the last 24 hours. The sixth is closed with a note to try again tomorrow.
• The repo isn't on the list. There's nothing to act on.
• The form is incomplete, or the reason isn't one from the list. Open a new report and fill in every required field.

Found a security hole in DevStream itself?

That's different. Don't open a public issue. Report it privately, as described on Security.

Related

• Removal Policy: what hidden, archived and superseded mean.
• Trust Checks: trusted and established accounts.