Reporting an Entry

Spotted spam on the list, a repo that's turned nasty, or one that died months ago? Tell us. It takes about 30 seconds, and a maintainer reads every report.

File a report

1. Open the Report an entry form.
2. Entry: the listed repo, as a GitHub link or owner/name.
3. Reason: pick the one that fits. They're explained below.
4. Replaced by: only for "Replaced by something better". Give the replacement as owner/name.
5. Details: anything that helps us check, such as a link to the malicious file or the issue where the maintainer said they'd stopped. A few sentences is plenty.
6. Select Submit new issue.

Please don't edit the report after you've filed it. An edited report no longer counts toward hiding an entry, because what it says may not be what the bot read.

The reasons

Reason	Use it for
Spam or SEO	A repo that exists to advertise something, game search results, or pad someone's profile
Malicious (malware, phishing, stolen code)	Anything that harms the people who install or visit it
Dead or abandoned	A repo that has stopped working, or that its maintainer has walked away from
Replaced by something better	A repo that a fork or successor has taken over from
Wrong category	A repo filed in a category that doesn't fit. Tell us the right one in Details.
Something else	Anything that doesn't fit the above

What the bot does with it

The bot replies within a few minutes. Every report about a listed repo gets the needs-review label and goes to a maintainer. Some reasons also trigger something straight away:

Reason	What happens now
Malicious	If you have an established account, the entry is hidden at once while a maintainer reviews it. Otherwise it's queued.
Spam or SEO, Something else	Once 3 different established accounts have open reports on the same entry, it's hidden while a maintainer reviews it. Until then, each report is queued.
Dead or abandoned	The bot runs the health check on that repo right away, instead of waiting for Monday.
Replaced by something better	Labelled superseded and queued. A maintainer compares the two and decides what stays listed.
Wrong category	Queued for a maintainer.

Hidden means off the list, not deleted. If the review finds nothing wrong, a maintainer puts it back.

A maintainer makes the final call on every reported entry. The replacement in a "Replaced by" report is only listed if it passes the Quality Bar like any other repo.

When a report isn't acted on automatically

The bot still passes these to a maintainer, but it doesn't hide anything or count them toward a hide:

• Your account doesn't pass the trust rule. The report waits for a maintainer to read it.
• Your account isn't established yet. A malicious, spam or "something else" report is queued, but it can't hide an entry.
• The entry is already hidden. Your report joins the review that's already open.

And these are closed straight away:

• You've filed 5 reports in the last 24 hours. The sixth is closed with a note to try again tomorrow.
• The repo isn't on the list. There's nothing for us to act on.
• The form is incomplete, or the reason isn't one from the list. Open a new report and fill in every required field.

Found a security hole in DevStream itself?

That's different. Don't open a public issue. Report it privately, as described on Security.

Related

• Removal Policy: what hidden, archived and superseded mean.
• Trust Checks: trusted and established accounts.